1 // Copyright 2017 The Chromium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include <fuzzer/FuzzedDataProvider.h>
6
7 #include <algorithm>
8
9 #include "base/logging.h"
10 #include "base/run_loop.h"
11 #include "net/base/host_port_pair.h"
12 #include "net/base/net_errors.h"
13 #include "net/base/request_priority.h"
14 #include "net/base/session_usage.h"
15 #include "net/cert/x509_certificate.h"
16 #include "net/dns/public/secure_dns_policy.h"
17 #include "net/log/net_log.h"
18 #include "net/log/net_log_source.h"
19 #include "net/log/test_net_log.h"
20 #include "net/socket/fuzzed_socket_factory.h"
21 #include "net/socket/socket_tag.h"
22 #include "net/socket/socket_test_util.h"
23 #include "net/socket/ssl_client_socket.h"
24 #include "net/spdy/spdy_test_util_common.h"
25 #include "net/ssl/ssl_config.h"
26 #include "net/third_party/quiche/src/quiche/common/http/http_header_block.h"
27 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
28
29 namespace {
30
31 const uint8_t kCertData[] = {
32 #include "net/data/ssl/certificates/spdy_pooling.inc"
33 };
34
35 class FuzzerDelegate : public net::SpdyStream::Delegate {
36 public:
FuzzerDelegate(base::OnceClosure done_closure)37 explicit FuzzerDelegate(base::OnceClosure done_closure)
38 : done_closure_(std::move(done_closure)) {}
39
40 FuzzerDelegate(const FuzzerDelegate&) = delete;
41 FuzzerDelegate& operator=(const FuzzerDelegate&) = delete;
42
OnHeadersSent()43 void OnHeadersSent() override {}
OnEarlyHintsReceived(const quiche::HttpHeaderBlock & headers)44 void OnEarlyHintsReceived(const quiche::HttpHeaderBlock& headers) override {}
OnHeadersReceived(const quiche::HttpHeaderBlock & response_headers)45 void OnHeadersReceived(
46 const quiche::HttpHeaderBlock& response_headers) override {}
OnDataReceived(std::unique_ptr<net::SpdyBuffer> buffer)47 void OnDataReceived(std::unique_ptr<net::SpdyBuffer> buffer) override {}
OnDataSent()48 void OnDataSent() override {}
OnTrailers(const quiche::HttpHeaderBlock & trailers)49 void OnTrailers(const quiche::HttpHeaderBlock& trailers) override {}
OnClose(int status)50 void OnClose(int status) override { std::move(done_closure_).Run(); }
CanGreaseFrameType() const51 bool CanGreaseFrameType() const override { return false; }
52
source_dependency() const53 net::NetLogSource source_dependency() const override {
54 return net::NetLogSource();
55 }
56
57 private:
58 base::OnceClosure done_closure_;
59 };
60
61 } // namespace
62
63 namespace net {
64
65 namespace {
66
67 class FuzzedSocketFactoryWithMockSSLData : public FuzzedSocketFactory {
68 public:
69 explicit FuzzedSocketFactoryWithMockSSLData(
70 FuzzedDataProvider* data_provider);
71
72 void AddSSLSocketDataProvider(SSLSocketDataProvider* socket);
73
74 std::unique_ptr<SSLClientSocket> CreateSSLClientSocket(
75 SSLClientContext* context,
76 std::unique_ptr<StreamSocket> nested_socket,
77 const HostPortPair& host_and_port,
78 const SSLConfig& ssl_config) override;
79
80 private:
81 SocketDataProviderArray<SSLSocketDataProvider> mock_ssl_data_;
82 };
83
FuzzedSocketFactoryWithMockSSLData(FuzzedDataProvider * data_provider)84 FuzzedSocketFactoryWithMockSSLData::FuzzedSocketFactoryWithMockSSLData(
85 FuzzedDataProvider* data_provider)
86 : FuzzedSocketFactory(data_provider) {}
87
AddSSLSocketDataProvider(SSLSocketDataProvider * data)88 void FuzzedSocketFactoryWithMockSSLData::AddSSLSocketDataProvider(
89 SSLSocketDataProvider* data) {
90 mock_ssl_data_.Add(data);
91 }
92
93 std::unique_ptr<SSLClientSocket>
CreateSSLClientSocket(SSLClientContext * context,std::unique_ptr<StreamSocket> nested_socket,const HostPortPair & host_and_port,const SSLConfig & ssl_config)94 FuzzedSocketFactoryWithMockSSLData::CreateSSLClientSocket(
95 SSLClientContext* context,
96 std::unique_ptr<StreamSocket> nested_socket,
97 const HostPortPair& host_and_port,
98 const SSLConfig& ssl_config) {
99 return std::make_unique<MockSSLClientSocket>(std::move(nested_socket),
100 host_and_port, ssl_config,
101 mock_ssl_data_.GetNext());
102 }
103
104 } // namespace
105
106 } // namespace net
107
108 // Fuzzer for SpdySession
109 //
110 // |data| is used to create a FuzzedServerSocket.
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)111 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
112 // Including an observer; even though the recorded results aren't currently
113 // used, it'll ensure the netlogging code is fuzzed as well.
114 net::RecordingNetLogObserver net_log_observer;
115 net::NetLogWithSource net_log_with_source =
116 net::NetLogWithSource::Make(net::NetLogSourceType::NONE);
117 FuzzedDataProvider data_provider(data, size);
118 net::FuzzedSocketFactoryWithMockSSLData socket_factory(&data_provider);
119 socket_factory.set_fuzz_connect_result(false);
120
121 net::SSLSocketDataProvider ssl_provider(net::ASYNC, net::OK);
122 ssl_provider.ssl_info.cert = net::X509Certificate::CreateFromBytes(kCertData);
123 CHECK(ssl_provider.ssl_info.cert);
124 socket_factory.AddSSLSocketDataProvider(&ssl_provider);
125
126 net::SpdySessionDependencies deps;
127 std::unique_ptr<net::HttpNetworkSession> http_session(
128 net::SpdySessionDependencies::SpdyCreateSessionWithSocketFactory(
129 &deps, &socket_factory));
130
131 net::SpdySessionKey session_key(
132 net::HostPortPair("127.0.0.1", 80), net::PRIVACY_MODE_DISABLED,
133 net::ProxyChain::Direct(), net::SessionUsage::kDestination,
134 net::SocketTag(), net::NetworkAnonymizationKey(),
135 net::SecureDnsPolicy::kAllow,
136 /*disable_cert_verification_network_fetches=*/false);
137 base::WeakPtr<net::SpdySession> spdy_session(net::CreateSpdySession(
138 http_session.get(), session_key, net_log_with_source));
139
140 net::SpdyStreamRequest stream_request;
141 base::WeakPtr<net::SpdyStream> stream;
142
143 net::TestCompletionCallback wait_for_start;
144 int rv = stream_request.StartRequest(
145 net::SPDY_REQUEST_RESPONSE_STREAM, spdy_session,
146 GURL("http://www.example.invalid/"), /*can_send_early=*/false,
147 net::DEFAULT_PRIORITY, net::SocketTag(), net_log_with_source,
148 wait_for_start.callback(), TRAFFIC_ANNOTATION_FOR_TESTS);
149
150 if (rv == net::ERR_IO_PENDING) {
151 rv = wait_for_start.WaitForResult();
152 }
153
154 // Re-check the status after potential event loop.
155 if (rv != net::OK) {
156 LOG(WARNING) << "StartRequest failed with result=" << rv;
157 return 0;
158 }
159
160 stream = stream_request.ReleaseStream();
161 stream->SendRequestHeaders(
162 net::SpdyTestUtil::ConstructGetHeaderBlock("http://www.example.invalid"),
163 net::NO_MORE_DATA_TO_SEND);
164
165 base::RunLoop run_loop;
166 FuzzerDelegate delegate(run_loop.QuitClosure());
167 stream->SetDelegate(&delegate);
168 run_loop.Run();
169
170 // Give a chance for GOING_AWAY sessions to wrap up.
171 base::RunLoop().RunUntilIdle();
172
173 return 0;
174 }
175