test/core/security/ssl_server_fuzzer.cc

   1 /*
   2  *
   3  * Copyright 2016 gRPC authors.
   4  *
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  *
  17  */
  18
  19 #include <grpc/grpc.h>
  20 #include <grpc/grpc_security.h>
  21 #include <grpc/support/log.h>
  22
  23 #include "src/core/lib/iomgr/load_file.h"
  24 #include "src/core/lib/security/credentials/credentials.h"
  25 #include "src/core/lib/security/security_connector/security_connector.h"
  26 #include "test/core/util/mock_endpoint.h"
  27
  28 #define CA_CERT_PATH "src/core/tsi/test_creds/ca.pem"
  29 #define SERVER_CERT_PATH "src/core/tsi/test_creds/server1.pem"
  30 #define SERVER_KEY_PATH "src/core/tsi/test_creds/server1.key"
  31
  32 bool squelch = true;
  33 // ssl has an array of global gpr_mu's that are never released.
  34 // Turning this on will fail the leak check.
  35 bool leak_check = false;
  36
  37 static void discard_write(grpc_slice /*slice*/) {}
  38
  39 static void dont_log(gpr_log_func_args* /*args*/) {}
  40
  41 struct handshake_state {
  42   bool done_callback_called;
  43 };
  44
  45 static void on_handshake_done(void* arg, grpc_error_handle error) {
  46   grpc_core::HandshakerArgs* args =
  47       static_cast<grpc_core::HandshakerArgs*>(arg);
  48   struct handshake_state* state =
  49       static_cast<struct handshake_state*>(args->user_data);
  50   GPR_ASSERT(state->done_callback_called == false);
  51   state->done_callback_called = true;
  52   // The fuzzer should not pass the handshake.
  53   GPR_ASSERT(error != GRPC_ERROR_NONE);
  54 }
  55
  56 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
  57   if (squelch) gpr_set_log_function(dont_log);
  58   grpc_init();
  59   {
  60     grpc_core::ExecCtx exec_ctx;
  61
  62     grpc_resource_quota* resource_quota =
  63         grpc_resource_quota_create("ssl_server_fuzzer");
  64     grpc_endpoint* mock_endpoint =
  65         grpc_mock_endpoint_create(discard_write, resource_quota);
  66     grpc_resource_quota_unref_internal(resource_quota);
  67
  68     grpc_mock_endpoint_put_read(
  69         mock_endpoint, grpc_slice_from_copied_buffer((const char*)data, size));
  70
  71     // Load key pair and establish server SSL credentials.
  72     grpc_slice ca_slice, cert_slice, key_slice;
  73     GPR_ASSERT(GRPC_LOG_IF_ERROR("load_file",
  74                                  grpc_load_file(CA_CERT_PATH, 1, &ca_slice)));
  75     GPR_ASSERT(GRPC_LOG_IF_ERROR(
  76         "load_file", grpc_load_file(SERVER_CERT_PATH, 1, &cert_slice)));
  77     GPR_ASSERT(GRPC_LOG_IF_ERROR(
  78         "load_file", grpc_load_file(SERVER_KEY_PATH, 1, &key_slice)));
  79     const char* ca_cert =
  80         reinterpret_cast<const char*> GRPC_SLICE_START_PTR(ca_slice);
  81     const char* server_cert =
  82         reinterpret_cast<const char*> GRPC_SLICE_START_PTR(cert_slice);
  83     const char* server_key =
  84         reinterpret_cast<const char*> GRPC_SLICE_START_PTR(key_slice);
  85     grpc_ssl_pem_key_cert_pair pem_key_cert_pair = {server_key, server_cert};
  86     grpc_server_credentials* creds = grpc_ssl_server_credentials_create(
  87         ca_cert, &pem_key_cert_pair, 1, 0, nullptr);
  88     grpc_slice_unref(cert_slice);
  89     grpc_slice_unref(key_slice);
  90     grpc_slice_unref(ca_slice);
  91
  92     // Create security connector
  93     grpc_core::RefCountedPtr<grpc_server_security_connector> sc =
  94         creds->create_security_connector(nullptr);
  95     GPR_ASSERT(sc != nullptr);
  96     grpc_millis deadline = GPR_MS_PER_SEC + grpc_core::ExecCtx::Get()->Now();
  97
  98     struct handshake_state state;
  99     state.done_callback_called = false;
 100     auto handshake_mgr =
 101         grpc_core::MakeRefCounted<grpc_core::HandshakeManager>();
 102     sc->add_handshakers(nullptr, nullptr, handshake_mgr.get());
 103     handshake_mgr->DoHandshake(mock_endpoint, nullptr /* channel_args */,
 104                                deadline, nullptr /* acceptor */,
 105                                on_handshake_done, &state);
 106     grpc_core::ExecCtx::Get()->Flush();
 107
 108     // If the given string happens to be part of the correct client hello, the
 109     // server will wait for more data. Explicitly fail the server by shutting
 110     // down the endpoint.
 111     if (!state.done_callback_called) {
 112       grpc_endpoint_shutdown(
 113           mock_endpoint,
 114           GRPC_ERROR_CREATE_FROM_STATIC_STRING("Explicit close"));
 115       grpc_core::ExecCtx::Get()->Flush();
 116     }
 117
 118     GPR_ASSERT(state.done_callback_called);
 119
 120     sc.reset(DEBUG_LOCATION, "test");
 121     grpc_server_credentials_release(creds);
 122     grpc_core::ExecCtx::Get()->Flush();
 123   }
 124
 125   grpc_shutdown();
 126   return 0;
 127 }