1 /*
2 *
3 * Copyright 2016 gRPC authors.
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 */
18
19 #include <grpc/grpc.h>
20 #include <grpc/grpc_security.h>
21 #include <grpc/support/log.h>
22
23 #include "src/core/lib/iomgr/load_file.h"
24 #include "src/core/lib/security/credentials/credentials.h"
25 #include "src/core/lib/security/security_connector/security_connector.h"
26 #include "test/core/end2end/data/ssl_test_data.h"
27 #include "test/core/util/memory_counters.h"
28 #include "test/core/util/mock_endpoint.h"
29
30 bool squelch = true;
31 // ssl has an array of global gpr_mu's that are never released.
32 // Turning this on will fail the leak check.
33 bool leak_check = false;
34
discard_write(grpc_slice slice)35 static void discard_write(grpc_slice slice) {}
36
dont_log(gpr_log_func_args * args)37 static void dont_log(gpr_log_func_args* args) {}
38
39 struct handshake_state {
40 bool done_callback_called;
41 };
42
on_handshake_done(void * arg,grpc_error * error)43 static void on_handshake_done(void* arg, grpc_error* error) {
44 grpc_handshaker_args* args = static_cast<grpc_handshaker_args*>(arg);
45 struct handshake_state* state =
46 static_cast<struct handshake_state*>(args->user_data);
47 GPR_ASSERT(state->done_callback_called == false);
48 state->done_callback_called = true;
49 // The fuzzer should not pass the handshake.
50 GPR_ASSERT(error != GRPC_ERROR_NONE);
51 }
52
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)53 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
54 struct grpc_memory_counters counters;
55 if (squelch) gpr_set_log_function(dont_log);
56 if (leak_check) grpc_memory_counters_init();
57 grpc_init();
58 {
59 grpc_core::ExecCtx exec_ctx;
60
61 grpc_resource_quota* resource_quota =
62 grpc_resource_quota_create("ssl_server_fuzzer");
63 grpc_endpoint* mock_endpoint =
64 grpc_mock_endpoint_create(discard_write, resource_quota);
65 grpc_resource_quota_unref_internal(resource_quota);
66
67 grpc_mock_endpoint_put_read(
68 mock_endpoint, grpc_slice_from_copied_buffer((const char*)data, size));
69
70 // Load key pair and establish server SSL credentials.
71 grpc_ssl_pem_key_cert_pair pem_key_cert_pair;
72 grpc_slice ca_slice, cert_slice, key_slice;
73 ca_slice = grpc_slice_from_static_string(test_root_cert);
74 cert_slice = grpc_slice_from_static_string(test_server1_cert);
75 key_slice = grpc_slice_from_static_string(test_server1_key);
76 const char* ca_cert = (const char*)GRPC_SLICE_START_PTR(ca_slice);
77 pem_key_cert_pair.private_key =
78 (const char*)GRPC_SLICE_START_PTR(key_slice);
79 pem_key_cert_pair.cert_chain =
80 (const char*)GRPC_SLICE_START_PTR(cert_slice);
81 grpc_server_credentials* creds = grpc_ssl_server_credentials_create(
82 ca_cert, &pem_key_cert_pair, 1, 0, nullptr);
83
84 // Create security connector
85 grpc_server_security_connector* sc = nullptr;
86 grpc_security_status status =
87 grpc_server_credentials_create_security_connector(creds, &sc);
88 GPR_ASSERT(status == GRPC_SECURITY_OK);
89 grpc_millis deadline = GPR_MS_PER_SEC + grpc_core::ExecCtx::Get()->Now();
90
91 struct handshake_state state;
92 state.done_callback_called = false;
93 grpc_handshake_manager* handshake_mgr = grpc_handshake_manager_create();
94 grpc_server_security_connector_add_handshakers(sc, handshake_mgr);
95 grpc_handshake_manager_do_handshake(
96 handshake_mgr, nullptr /* interested_parties */, mock_endpoint,
97 nullptr /* channel_args */, deadline, nullptr /* acceptor */,
98 on_handshake_done, &state);
99 grpc_core::ExecCtx::Get()->Flush();
100
101 // If the given string happens to be part of the correct client hello, the
102 // server will wait for more data. Explicitly fail the server by shutting
103 // down the endpoint.
104 if (!state.done_callback_called) {
105 grpc_endpoint_shutdown(
106 mock_endpoint,
107 GRPC_ERROR_CREATE_FROM_STATIC_STRING("Explicit close"));
108 grpc_core::ExecCtx::Get()->Flush();
109 }
110
111 GPR_ASSERT(state.done_callback_called);
112
113 grpc_handshake_manager_destroy(handshake_mgr);
114 GRPC_SECURITY_CONNECTOR_UNREF(&sc->base, "test");
115 grpc_server_credentials_release(creds);
116 grpc_slice_unref(cert_slice);
117 grpc_slice_unref(key_slice);
118 grpc_slice_unref(ca_slice);
119 grpc_core::ExecCtx::Get()->Flush();
120 }
121
122 grpc_shutdown();
123 if (leak_check) {
124 counters = grpc_memory_counters_snapshot();
125 grpc_memory_counters_destroy();
126 GPR_ASSERT(counters.total_size_relative == 0);
127 }
128 return 0;
129 }
130