1 // Copyright 2017 The Chromium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include <fuzzer/FuzzedDataProvider.h>
6
7 #include "base/check_op.h"
8 #include "base/memory/raw_ptr.h"
9 #include "base/run_loop.h"
10 #include "net/base/net_errors.h"
11 #include "net/log/net_log.h"
12 #include "net/log/test_net_log.h"
13 #include "net/server/http_server.h"
14 #include "net/socket/fuzzed_server_socket.h"
15 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
16
17 namespace {
18
19 // Restrict the max size of the input. This prevents a timeout when the fuzzer
20 // finds the O(N^2) behavior of header parsing.
21 // TODO(https://crbug.com/370858119): Increase the limit if the O(N^2) behavior
22 // is fixed.
23 constexpr size_t kMaxInputSize = 32 * 1024;
24
25 class WaitTillHttpCloseDelegate : public net::HttpServer::Delegate {
26 public:
WaitTillHttpCloseDelegate(FuzzedDataProvider * data_provider,base::OnceClosure done_closure)27 WaitTillHttpCloseDelegate(FuzzedDataProvider* data_provider,
28 base::OnceClosure done_closure)
29 : data_provider_(data_provider),
30 done_closure_(std::move(done_closure)),
31 action_flags_(data_provider_->ConsumeIntegral<uint8_t>()) {}
32
33 WaitTillHttpCloseDelegate(const WaitTillHttpCloseDelegate&) = delete;
34 WaitTillHttpCloseDelegate& operator=(const WaitTillHttpCloseDelegate&) =
35 delete;
36
set_server(net::HttpServer * server)37 void set_server(net::HttpServer* server) { server_ = server; }
38
OnConnect(int connection_id)39 void OnConnect(int connection_id) override {
40 if (!(action_flags_ & ACCEPT_CONNECTION))
41 server_->Close(connection_id);
42 }
43
OnHttpRequest(int connection_id,const net::HttpServerRequestInfo & info)44 void OnHttpRequest(int connection_id,
45 const net::HttpServerRequestInfo& info) override {
46 if (!(action_flags_ & ACCEPT_MESSAGE)) {
47 server_->Close(connection_id);
48 return;
49 }
50
51 if (action_flags_ & REPLY_TO_MESSAGE) {
52 server_->Send200(connection_id,
53 data_provider_->ConsumeRandomLengthString(64),
54 "text/html", TRAFFIC_ANNOTATION_FOR_TESTS);
55 }
56 }
57
OnWebSocketRequest(int connection_id,const net::HttpServerRequestInfo & info)58 void OnWebSocketRequest(int connection_id,
59 const net::HttpServerRequestInfo& info) override {
60 if (action_flags_ & CLOSE_WEBSOCKET_RATHER_THAN_ACCEPT) {
61 server_->Close(connection_id);
62 return;
63 }
64
65 if (action_flags_ & ACCEPT_WEBSOCKET)
66 server_->AcceptWebSocket(connection_id, info,
67 TRAFFIC_ANNOTATION_FOR_TESTS);
68 }
69
OnWebSocketMessage(int connection_id,std::string data)70 void OnWebSocketMessage(int connection_id, std::string data) override {
71 if (!(action_flags_ & ACCEPT_MESSAGE)) {
72 server_->Close(connection_id);
73 return;
74 }
75
76 if (action_flags_ & REPLY_TO_MESSAGE) {
77 server_->SendOverWebSocket(connection_id,
78 data_provider_->ConsumeRandomLengthString(64),
79 TRAFFIC_ANNOTATION_FOR_TESTS);
80 }
81 }
82
OnClose(int connection_id)83 void OnClose(int connection_id) override {
84 // In general, OnClose can be called more than once, but FuzzedServerSocket
85 // only makes one connection, and it is the only socket of interest here.
86 std::move(done_closure_).Run();
87 }
88
89 private:
90 enum {
91 ACCEPT_CONNECTION = 1,
92 ACCEPT_MESSAGE = 2,
93 REPLY_TO_MESSAGE = 4,
94 ACCEPT_WEBSOCKET = 8,
95 CLOSE_WEBSOCKET_RATHER_THAN_ACCEPT = 16
96 };
97
98 raw_ptr<net::HttpServer> server_ = nullptr;
99 const raw_ptr<FuzzedDataProvider> data_provider_;
100 base::OnceClosure done_closure_;
101 const uint8_t action_flags_;
102 };
103
104 } // namespace
105
106 // Fuzzer for HttpServer
107 //
108 // |data| is used to create a FuzzedServerSocket.
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)109 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
110 if (size > kMaxInputSize) {
111 return 0;
112 }
113
114 // Including an observer; even though the recorded results aren't currently
115 // used, it'll ensure the netlogging code is fuzzed as well.
116 net::RecordingNetLogObserver net_log_observer;
117 FuzzedDataProvider data_provider(data, size);
118
119 std::unique_ptr<net::ServerSocket> server_socket(
120 std::make_unique<net::FuzzedServerSocket>(&data_provider,
121 net::NetLog::Get()));
122 CHECK_EQ(net::OK,
123 server_socket->ListenWithAddressAndPort("127.0.0.1", 80, 5));
124
125 base::RunLoop run_loop;
126 WaitTillHttpCloseDelegate delegate(&data_provider, run_loop.QuitClosure());
127 net::HttpServer server(std::move(server_socket), &delegate);
128 delegate.set_server(&server);
129 run_loop.Run();
130 return 0;
131 }
132