1 /*
2 *
3 * Copyright 2016 gRPC authors.
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 */
18
19 #include <grpc/grpc.h>
20 #include <grpc/grpc_security.h>
21 #include <grpc/support/log.h>
22
23 #include "src/core/lib/iomgr/load_file.h"
24 #include "src/core/lib/security/credentials/credentials.h"
25 #include "src/core/lib/security/security_connector/security_connector.h"
26 #include "test/core/util/mock_endpoint.h"
27
28 #define CA_CERT_PATH "src/core/tsi/test_creds/ca.pem"
29 #define SERVER_CERT_PATH "src/core/tsi/test_creds/server1.pem"
30 #define SERVER_KEY_PATH "src/core/tsi/test_creds/server1.key"
31
32 bool squelch = true;
33 // ssl has an array of global gpr_mu's that are never released.
34 // Turning this on will fail the leak check.
35 bool leak_check = false;
36
discard_write(grpc_slice)37 static void discard_write(grpc_slice /*slice*/) {}
38
dont_log(gpr_log_func_args *)39 static void dont_log(gpr_log_func_args* /*args*/) {}
40
41 struct handshake_state {
42 bool done_callback_called;
43 };
44
on_handshake_done(void * arg,grpc_error * error)45 static void on_handshake_done(void* arg, grpc_error* error) {
46 grpc_core::HandshakerArgs* args =
47 static_cast<grpc_core::HandshakerArgs*>(arg);
48 struct handshake_state* state =
49 static_cast<struct handshake_state*>(args->user_data);
50 GPR_ASSERT(state->done_callback_called == false);
51 state->done_callback_called = true;
52 // The fuzzer should not pass the handshake.
53 GPR_ASSERT(error != GRPC_ERROR_NONE);
54 }
55
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)56 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
57 if (squelch) gpr_set_log_function(dont_log);
58 grpc_init();
59 {
60 grpc_core::ExecCtx exec_ctx;
61
62 grpc_resource_quota* resource_quota =
63 grpc_resource_quota_create("ssl_server_fuzzer");
64 grpc_endpoint* mock_endpoint =
65 grpc_mock_endpoint_create(discard_write, resource_quota);
66 grpc_resource_quota_unref_internal(resource_quota);
67
68 grpc_mock_endpoint_put_read(
69 mock_endpoint, grpc_slice_from_copied_buffer((const char*)data, size));
70
71 // Load key pair and establish server SSL credentials.
72 grpc_slice ca_slice, cert_slice, key_slice;
73 GPR_ASSERT(GRPC_LOG_IF_ERROR("load_file",
74 grpc_load_file(CA_CERT_PATH, 1, &ca_slice)));
75 GPR_ASSERT(GRPC_LOG_IF_ERROR(
76 "load_file", grpc_load_file(SERVER_CERT_PATH, 1, &cert_slice)));
77 GPR_ASSERT(GRPC_LOG_IF_ERROR(
78 "load_file", grpc_load_file(SERVER_KEY_PATH, 1, &key_slice)));
79 const char* ca_cert =
80 reinterpret_cast<const char*> GRPC_SLICE_START_PTR(ca_slice);
81 const char* server_cert =
82 reinterpret_cast<const char*> GRPC_SLICE_START_PTR(cert_slice);
83 const char* server_key =
84 reinterpret_cast<const char*> GRPC_SLICE_START_PTR(key_slice);
85 grpc_ssl_pem_key_cert_pair pem_key_cert_pair = {server_key, server_cert};
86 grpc_server_credentials* creds = grpc_ssl_server_credentials_create(
87 ca_cert, &pem_key_cert_pair, 1, 0, nullptr);
88 grpc_slice_unref(cert_slice);
89 grpc_slice_unref(key_slice);
90 grpc_slice_unref(ca_slice);
91
92 // Create security connector
93 grpc_core::RefCountedPtr<grpc_server_security_connector> sc =
94 creds->create_security_connector();
95 GPR_ASSERT(sc != nullptr);
96 grpc_millis deadline = GPR_MS_PER_SEC + grpc_core::ExecCtx::Get()->Now();
97
98 struct handshake_state state;
99 state.done_callback_called = false;
100 auto handshake_mgr =
101 grpc_core::MakeRefCounted<grpc_core::HandshakeManager>();
102 sc->add_handshakers(nullptr, nullptr, handshake_mgr.get());
103 handshake_mgr->DoHandshake(mock_endpoint, nullptr /* channel_args */,
104 deadline, nullptr /* acceptor */,
105 on_handshake_done, &state);
106 grpc_core::ExecCtx::Get()->Flush();
107
108 // If the given string happens to be part of the correct client hello, the
109 // server will wait for more data. Explicitly fail the server by shutting
110 // down the endpoint.
111 if (!state.done_callback_called) {
112 grpc_endpoint_shutdown(
113 mock_endpoint,
114 GRPC_ERROR_CREATE_FROM_STATIC_STRING("Explicit close"));
115 grpc_core::ExecCtx::Get()->Flush();
116 }
117
118 GPR_ASSERT(state.done_callback_called);
119
120 sc.reset(DEBUG_LOCATION, "test");
121 grpc_server_credentials_release(creds);
122 grpc_core::ExecCtx::Get()->Flush();
123 }
124
125 grpc_shutdown_blocking();
126 return 0;
127 }
128