net/quic/quic_stream_factory_fuzzer.cc

   1 // Copyright 2017 The Chromium Authors
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "net/quic/quic_stream_factory.h"
   6
   7 #include <fuzzer/FuzzedDataProvider.h>
   8
   9 #include <algorithm>
  10
  11 #include "base/no_destructor.h"
  12 #include "base/task/sequenced_task_runner.h"
  13 #include "net/base/network_anonymization_key.h"
  14 #include "net/base/test_completion_callback.h"
  15 #include "net/cert/ct_policy_enforcer.h"
  16 #include "net/cert/do_nothing_ct_verifier.h"
  17 #include "net/cert/mock_cert_verifier.h"
  18 #include "net/cert/x509_certificate.h"
  19 #include "net/dns/context_host_resolver.h"
  20 #include "net/dns/fuzzed_host_resolver_util.h"
  21 #include "net/dns/host_resolver_system_task.h"
  22 #include "net/dns/public/secure_dns_policy.h"
  23 #include "net/http/http_server_properties.h"
  24 #include "net/http/transport_security_state.h"
  25 #include "net/quic/mock_crypto_client_stream_factory.h"
  26 #include "net/quic/mock_quic_context.h"
  27 #include "net/quic/quic_context.h"
  28 #include "net/quic/quic_http_stream.h"
  29 #include "net/quic/test_task_runner.h"
  30 #include "net/socket/fuzzed_datagram_client_socket.h"
  31 #include "net/socket/fuzzed_socket_factory.h"
  32 #include "net/socket/socket_tag.h"
  33 #include "net/ssl/ssl_config_service_defaults.h"
  34 #include "net/test/gtest_util.h"
  35 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
  36 #include "url/scheme_host_port.h"
  37 #include "url/url_constants.h"
  38
  39 namespace net {
  40
  41 namespace {
  42
  43 const uint8_t kCertData[] = {
  44 #include "net/data/ssl/certificates/wildcard.inc"
  45 };
  46
  47 }  // namespace
  48
  49 namespace test {
  50
  51 const char kServerHostName[] = "www.example.org";
  52 const int kServerPort = 443;
  53 const char kUrl[] = "https://www.example.org/";
  54 // TODO(nedwilliamson): Add POST here after testing
  55 // whether that can lead blocking while waiting for
  56 // the callbacks.
  57 const char kMethod[] = "GET";
  58 const size_t kBufferSize = 4096;
  59 const int kCertVerifyFlags = 0;
  60
  61 // Persistent factory data, statically initialized on the first time
  62 // LLVMFuzzerTestOneInput is called.
  63 struct FuzzerEnvironment {
  64   FuzzerEnvironment()
  65       : scheme_host_port(url::kHttpsScheme, kServerHostName, kServerPort) {
  66     net::SetSystemDnsResolutionTaskRunnerForTesting(  // IN-TEST
  67         base::SequencedTaskRunner::GetCurrentDefault());
  68
  69     quic_context.AdvanceTime(quic::QuicTime::Delta::FromSeconds(1));
  70     ssl_config_service = std::make_unique<SSLConfigServiceDefaults>();
  71     crypto_client_stream_factory.set_use_mock_crypter(true);
  72     cert_verifier = std::make_unique<MockCertVerifier>();
  73     verify_details.cert_verify_result.verified_cert =
  74         X509Certificate::CreateFromBytes(kCertData);
  75     CHECK(verify_details.cert_verify_result.verified_cert);
  76     verify_details.cert_verify_result.is_issued_by_known_root = true;
  77   }
  78   ~FuzzerEnvironment() = default;
  79
  80   std::unique_ptr<SSLConfigService> ssl_config_service;
  81   ProofVerifyDetailsChromium verify_details;
  82   MockCryptoClientStreamFactory crypto_client_stream_factory;
  83   url::SchemeHostPort scheme_host_port;
  84   NetLogWithSource net_log;
  85   std::unique_ptr<CertVerifier> cert_verifier;
  86   TransportSecurityState transport_security_state;
  87   quic::QuicTagVector connection_options;
  88   quic::QuicTagVector client_connection_options;
  89   DefaultCTPolicyEnforcer ct_policy_enforcer;
  90   MockQuicContext quic_context;
  91 };
  92
  93 FuzzerEnvironment* GetFuzzerEnvironment() {
  94   static base::NoDestructor<FuzzerEnvironment> fuzzer_environment;
  95   return &*fuzzer_environment;
  96 }
  97
  98 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
  99   FuzzedDataProvider data_provider(data, size);
 100
 101   FuzzerEnvironment* env = GetFuzzerEnvironment();
 102
 103   std::unique_ptr<ContextHostResolver> host_resolver =
 104       CreateFuzzedContextHostResolver(HostResolver::ManagerOptions(), nullptr,
 105                                       &data_provider,
 106                                       true /* enable_caching */);
 107   FuzzedSocketFactory socket_factory(&data_provider);
 108
 109   // Initialize this on each loop since some options mutate this.
 110   HttpServerProperties http_server_properties;
 111
 112   QuicParams& params = *env->quic_context.params();
 113   params.max_server_configs_stored_in_properties =
 114       data_provider.ConsumeBool() ? 1 : 0;
 115   params.close_sessions_on_ip_change = data_provider.ConsumeBool();
 116   params.allow_server_migration = data_provider.ConsumeBool();
 117   params.estimate_initial_rtt = data_provider.ConsumeBool();
 118   params.enable_socket_recv_optimization = data_provider.ConsumeBool();
 119
 120   env->crypto_client_stream_factory.AddProofVerifyDetails(&env->verify_details);
 121
 122   params.goaway_sessions_on_ip_change = false;
 123   params.migrate_sessions_early_v2 = false;
 124   params.migrate_sessions_on_network_change_v2 = false;
 125   params.retry_on_alternate_network_before_handshake = false;
 126   params.migrate_idle_sessions = false;
 127
 128   if (!params.close_sessions_on_ip_change) {
 129     params.goaway_sessions_on_ip_change = data_provider.ConsumeBool();
 130     if (!params.goaway_sessions_on_ip_change) {
 131       params.migrate_sessions_on_network_change_v2 =
 132           data_provider.ConsumeBool();
 133       if (params.migrate_sessions_on_network_change_v2) {
 134         params.migrate_sessions_early_v2 = data_provider.ConsumeBool();
 135         params.retry_on_alternate_network_before_handshake =
 136             data_provider.ConsumeBool();
 137         params.migrate_idle_sessions = data_provider.ConsumeBool();
 138       }
 139     }
 140   }
 141
 142   std::unique_ptr<QuicStreamFactory> factory =
 143       std::make_unique<QuicStreamFactory>(
 144           env->net_log.net_log(), host_resolver.get(),
 145           env->ssl_config_service.get(), &socket_factory,
 146           &http_server_properties, env->cert_verifier.get(),
 147           &env->ct_policy_enforcer, &env->transport_security_state, nullptr,
 148           nullptr, &env->crypto_client_stream_factory, &env->quic_context);
 149
 150   QuicStreamRequest request(factory.get());
 151   TestCompletionCallback callback;
 152   NetErrorDetails net_error_details;
 153   quic::ParsedQuicVersionVector versions = AllSupportedQuicVersions();
 154   quic::ParsedQuicVersion version =
 155       versions[data_provider.ConsumeIntegralInRange<size_t>(
 156           0, versions.size() - 1)];
 157
 158   quic::QuicEnableVersion(version);
 159
 160   request.Request(
 161       env->scheme_host_port, version, PRIVACY_MODE_DISABLED, DEFAULT_PRIORITY,
 162       SocketTag(), NetworkAnonymizationKey(), SecureDnsPolicy::kAllow,
 163       true /* use_dns_aliases */, false /* require_dns_https_alpn */,
 164       kCertVerifyFlags, GURL(kUrl), env->net_log, &net_error_details,
 165       /*failed_on_default_network_callback=*/CompletionOnceCallback(),
 166       callback.callback());
 167
 168   callback.WaitForResult();
 169   std::unique_ptr<QuicChromiumClientSession::Handle> session =
 170       request.ReleaseSessionHandle();
 171   if (!session)
 172     return 0;
 173   auto dns_aliases = session->GetDnsAliasesForSessionKey(request.session_key());
 174   auto stream = std::make_unique<QuicHttpStream>(std::move(session),
 175                                                  std::move(dns_aliases));
 176
 177   HttpRequestInfo request_info;
 178   request_info.method = kMethod;
 179   request_info.url = GURL(kUrl);
 180   request_info.traffic_annotation =
 181       MutableNetworkTrafficAnnotationTag(TRAFFIC_ANNOTATION_FOR_TESTS);
 182   stream->RegisterRequest(&request_info);
 183   stream->InitializeStream(true, DEFAULT_PRIORITY, env->net_log,
 184                            CompletionOnceCallback());
 185
 186   HttpResponseInfo response;
 187   HttpRequestHeaders request_headers;
 188   if (OK !=
 189       stream->SendRequest(request_headers, &response, callback.callback()))
 190     return 0;
 191
 192   // TODO(nedwilliamson): attempt connection migration here
 193   int rv = stream->ReadResponseHeaders(callback.callback());
 194   if (rv != OK && rv != ERR_IO_PENDING) {
 195     return 0;
 196   }
 197   callback.WaitForResult();
 198
 199   scoped_refptr<net::IOBuffer> buffer =
 200       base::MakeRefCounted<net::IOBuffer>(kBufferSize);
 201   rv = stream->ReadResponseBody(buffer.get(), kBufferSize, callback.callback());
 202   if (rv == ERR_IO_PENDING)
 203     callback.WaitForResult();
 204
 205   return 0;
 206 }
 207
 208 }  // namespace test
 209 }  // namespace net