1 //
2 //
3 // Copyright 2016 gRPC authors.
4 //
5 // Licensed under the Apache License, Version 2.0 (the "License");
6 // you may not use this file except in compliance with the License.
7 // You may obtain a copy of the License at
8 //
9 // http://www.apache.org/licenses/LICENSE-2.0
10 //
11 // Unless required by applicable law or agreed to in writing, software
12 // distributed under the License is distributed on an "AS IS" BASIS,
13 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 // See the License for the specific language governing permissions and
15 // limitations under the License.
16 //
17 //
18
19 #include <grpc/event_engine/event_engine.h>
20 #include <grpc/grpc.h>
21 #include <grpc/grpc_security.h>
22 #include <grpc/support/log.h>
23
24 #include "src/core/lib/event_engine/default_event_engine.h"
25 #include "src/core/lib/gprpp/crash.h"
26 #include "src/core/lib/security/credentials/credentials.h"
27 #include "src/core/lib/security/security_connector/security_connector.h"
28 #include "test/core/util/mock_endpoint.h"
29 #include "test/core/util/tls_utils.h"
30
31 #define CA_CERT_PATH "src/core/tsi/test_creds/ca.pem"
32 #define SERVER_CERT_PATH "src/core/tsi/test_creds/server1.pem"
33 #define SERVER_KEY_PATH "src/core/tsi/test_creds/server1.key"
34
35 using grpc_event_engine::experimental::EventEngine;
36 using grpc_event_engine::experimental::GetDefaultEventEngine;
37
38 bool squelch = true;
39 // ssl has an array of global gpr_mu's that are never released.
40 // Turning this on will fail the leak check.
41 bool leak_check = false;
42
discard_write(grpc_slice)43 static void discard_write(grpc_slice /*slice*/) {}
44
dont_log(gpr_log_func_args *)45 static void dont_log(gpr_log_func_args* /*args*/) {}
46
47 struct handshake_state {
48 bool done_callback_called;
49 };
50
on_handshake_done(void * arg,grpc_error_handle error)51 static void on_handshake_done(void* arg, grpc_error_handle error) {
52 grpc_core::HandshakerArgs* args =
53 static_cast<grpc_core::HandshakerArgs*>(arg);
54 struct handshake_state* state =
55 static_cast<struct handshake_state*>(args->user_data);
56 GPR_ASSERT(state->done_callback_called == false);
57 state->done_callback_called = true;
58 // The fuzzer should not pass the handshake.
59 GPR_ASSERT(!error.ok());
60 }
61
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)62 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
63 if (squelch) gpr_set_log_function(dont_log);
64 grpc_init();
65 {
66 grpc_core::ExecCtx exec_ctx;
67
68 grpc_endpoint* mock_endpoint = grpc_mock_endpoint_create(discard_write);
69
70 grpc_mock_endpoint_put_read(
71 mock_endpoint, grpc_slice_from_copied_buffer((const char*)data, size));
72 grpc_mock_endpoint_finish_put_reads(mock_endpoint);
73
74 // Load key pair and establish server SSL credentials.
75 std::string ca_cert = grpc_core::testing::GetFileContents(CA_CERT_PATH);
76 std::string server_cert =
77 grpc_core::testing::GetFileContents(SERVER_CERT_PATH);
78 std::string server_key =
79 grpc_core::testing::GetFileContents(SERVER_KEY_PATH);
80 grpc_ssl_pem_key_cert_pair pem_key_cert_pair = {server_key.c_str(),
81 server_cert.c_str()};
82 grpc_server_credentials* creds = grpc_ssl_server_credentials_create(
83 ca_cert.c_str(), &pem_key_cert_pair, 1, 0, nullptr);
84
85 // Create security connector
86 grpc_core::RefCountedPtr<grpc_server_security_connector> sc =
87 creds->create_security_connector(grpc_core::ChannelArgs());
88 GPR_ASSERT(sc != nullptr);
89 grpc_core::Timestamp deadline =
90 grpc_core::Duration::Seconds(1) + grpc_core::Timestamp::Now();
91
92 struct handshake_state state;
93 state.done_callback_called = false;
94 auto handshake_mgr =
95 grpc_core::MakeRefCounted<grpc_core::HandshakeManager>();
96 auto channel_args = grpc_core::ChannelArgs().SetObject<EventEngine>(
97 GetDefaultEventEngine());
98 sc->add_handshakers(channel_args, nullptr, handshake_mgr.get());
99 handshake_mgr->DoHandshake(mock_endpoint, channel_args, deadline,
100 nullptr /* acceptor */, on_handshake_done,
101 &state);
102 grpc_core::ExecCtx::Get()->Flush();
103
104 // If the given string happens to be part of the correct client hello, the
105 // server will wait for more data. Explicitly fail the server by shutting
106 // down the endpoint.
107 if (!state.done_callback_called) {
108 grpc_endpoint_shutdown(mock_endpoint,
109 GRPC_ERROR_CREATE("Explicit close"));
110 grpc_core::ExecCtx::Get()->Flush();
111 }
112 GPR_ASSERT(state.done_callback_called);
113
114 sc.reset(DEBUG_LOCATION, "test");
115 grpc_server_credentials_release(creds);
116 grpc_core::ExecCtx::Get()->Flush();
117 }
118
119 grpc_shutdown();
120 return 0;
121 }
122