spdy_session_fuzzer.cc 6.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172
  1. // Copyright 2017 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include <fuzzer/FuzzedDataProvider.h>
  5. #include "base/cxx17_backports.h"
  6. #include "base/logging.h"
  7. #include "base/run_loop.h"
  8. #include "net/base/host_port_pair.h"
  9. #include "net/base/net_errors.h"
  10. #include "net/base/request_priority.h"
  11. #include "net/cert/x509_certificate.h"
  12. #include "net/dns/public/secure_dns_policy.h"
  13. #include "net/log/net_log.h"
  14. #include "net/log/net_log_source.h"
  15. #include "net/log/test_net_log.h"
  16. #include "net/socket/fuzzed_socket_factory.h"
  17. #include "net/socket/socket_tag.h"
  18. #include "net/socket/socket_test_util.h"
  19. #include "net/socket/ssl_client_socket.h"
  20. #include "net/spdy/spdy_test_util_common.h"
  21. #include "net/ssl/ssl_config.h"
  22. #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
  23. namespace {
  24. const uint8_t kCertData[] = {
  25. #include "net/data/ssl/certificates/spdy_pooling.inc"
  26. };
  27. class FuzzerDelegate : public net::SpdyStream::Delegate {
  28. public:
  29. explicit FuzzerDelegate(base::OnceClosure done_closure)
  30. : done_closure_(std::move(done_closure)) {}
  31. FuzzerDelegate(const FuzzerDelegate&) = delete;
  32. FuzzerDelegate& operator=(const FuzzerDelegate&) = delete;
  33. void OnHeadersSent() override {}
  34. void OnEarlyHintsReceived(const spdy::Http2HeaderBlock& headers) override {}
  35. void OnHeadersReceived(
  36. const spdy::Http2HeaderBlock& response_headers,
  37. const spdy::Http2HeaderBlock* pushed_request_headers) override {}
  38. void OnDataReceived(std::unique_ptr<net::SpdyBuffer> buffer) override {}
  39. void OnDataSent() override {}
  40. void OnTrailers(const spdy::Http2HeaderBlock& trailers) override {}
  41. void OnClose(int status) override { std::move(done_closure_).Run(); }
  42. bool CanGreaseFrameType() const override { return false; }
  43. net::NetLogSource source_dependency() const override {
  44. return net::NetLogSource();
  45. }
  46. private:
  47. base::OnceClosure done_closure_;
  48. };
  49. } // namespace
  50. namespace net {
  51. namespace {
  52. class FuzzedSocketFactoryWithMockSSLData : public FuzzedSocketFactory {
  53. public:
  54. explicit FuzzedSocketFactoryWithMockSSLData(
  55. FuzzedDataProvider* data_provider);
  56. void AddSSLSocketDataProvider(SSLSocketDataProvider* socket);
  57. std::unique_ptr<SSLClientSocket> CreateSSLClientSocket(
  58. SSLClientContext* context,
  59. std::unique_ptr<StreamSocket> nested_socket,
  60. const HostPortPair& host_and_port,
  61. const SSLConfig& ssl_config) override;
  62. private:
  63. SocketDataProviderArray<SSLSocketDataProvider> mock_ssl_data_;
  64. };
  65. FuzzedSocketFactoryWithMockSSLData::FuzzedSocketFactoryWithMockSSLData(
  66. FuzzedDataProvider* data_provider)
  67. : FuzzedSocketFactory(data_provider) {}
  68. void FuzzedSocketFactoryWithMockSSLData::AddSSLSocketDataProvider(
  69. SSLSocketDataProvider* data) {
  70. mock_ssl_data_.Add(data);
  71. }
  72. std::unique_ptr<SSLClientSocket>
  73. FuzzedSocketFactoryWithMockSSLData::CreateSSLClientSocket(
  74. SSLClientContext* context,
  75. std::unique_ptr<StreamSocket> nested_socket,
  76. const HostPortPair& host_and_port,
  77. const SSLConfig& ssl_config) {
  78. return std::make_unique<MockSSLClientSocket>(std::move(nested_socket),
  79. host_and_port, ssl_config,
  80. mock_ssl_data_.GetNext());
  81. }
  82. } // namespace
  83. } // namespace net
  84. // Fuzzer for SpdySession
  85. //
  86. // |data| is used to create a FuzzedServerSocket.
  87. extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
  88. // Including an observer; even though the recorded results aren't currently
  89. // used, it'll ensure the netlogging code is fuzzed as well.
  90. net::RecordingNetLogObserver net_log_observer;
  91. net::NetLogWithSource net_log_with_source =
  92. net::NetLogWithSource::Make(net::NetLogSourceType::NONE);
  93. FuzzedDataProvider data_provider(data, size);
  94. net::FuzzedSocketFactoryWithMockSSLData socket_factory(&data_provider);
  95. socket_factory.set_fuzz_connect_result(false);
  96. net::SSLSocketDataProvider ssl_provider(net::ASYNC, net::OK);
  97. ssl_provider.ssl_info.cert = net::X509Certificate::CreateFromBytes(kCertData);
  98. CHECK(ssl_provider.ssl_info.cert);
  99. socket_factory.AddSSLSocketDataProvider(&ssl_provider);
  100. net::SpdySessionDependencies deps;
  101. std::unique_ptr<net::HttpNetworkSession> http_session(
  102. net::SpdySessionDependencies::SpdyCreateSessionWithSocketFactory(
  103. &deps, &socket_factory));
  104. net::ProxyServer direct_connect(net::ProxyServer::Direct());
  105. net::SpdySessionKey session_key(net::HostPortPair("127.0.0.1", 80),
  106. direct_connect, net::PRIVACY_MODE_DISABLED,
  107. net::SpdySessionKey::IsProxySession::kFalse,
  108. net::SocketTag(), net::NetworkIsolationKey(),
  109. net::SecureDnsPolicy::kAllow);
  110. base::WeakPtr<net::SpdySession> spdy_session(net::CreateSpdySession(
  111. http_session.get(), session_key, net_log_with_source));
  112. net::SpdyStreamRequest stream_request;
  113. base::WeakPtr<net::SpdyStream> stream;
  114. net::TestCompletionCallback wait_for_start;
  115. int rv = stream_request.StartRequest(
  116. net::SPDY_REQUEST_RESPONSE_STREAM, spdy_session,
  117. GURL("http://www.example.invalid/"), false /* no early data */,
  118. net::DEFAULT_PRIORITY, net::SocketTag(), net_log_with_source,
  119. wait_for_start.callback(), TRAFFIC_ANNOTATION_FOR_TESTS);
  120. if (rv == net::ERR_IO_PENDING) {
  121. rv = wait_for_start.WaitForResult();
  122. }
  123. // Re-check the status after potential event loop.
  124. if (rv != net::OK) {
  125. LOG(WARNING) << "StartRequest failed with result=" << rv;
  126. return 0;
  127. }
  128. stream = stream_request.ReleaseStream();
  129. stream->SendRequestHeaders(
  130. net::SpdyTestUtil::ConstructGetHeaderBlock("http://www.example.invalid"),
  131. net::NO_MORE_DATA_TO_SEND);
  132. base::RunLoop run_loop;
  133. FuzzerDelegate delegate(run_loop.QuitClosure());
  134. stream->SetDelegate(&delegate);
  135. run_loop.Run();
  136. // Give a chance for GOING_AWAY sessions to wrap up.
  137. base::RunLoop().RunUntilIdle();
  138. return 0;
  139. }