1 // Copyright 2020 The Chromium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "net/dns/host_cache.h"
6
7 #include <stddef.h>
8 #include <stdint.h>
9 #include <stdlib.h>
10
11 #include <optional>
12
13 #include "base/json/json_reader.h"
14 #include "base/logging.h"
15 #include "base/numerics/clamped_math.h"
16 #include "base/numerics/ostream_operators.h"
17 #include "base/strings/string_piece.h"
18 #include "net/dns/host_cache_fuzzer.pb.h"
19 #include "testing/libfuzzer/proto/json.pb.h"
20 #include "testing/libfuzzer/proto/json_proto_converter.h"
21 #include "testing/libfuzzer/proto/lpm_interface.h"
22
23 namespace net {
24
25 struct Environment {
Environmentnet::Environment26 Environment() { logging::SetMinLogLevel(logging::LOGGING_INFO); }
27 const bool kDumpStats = getenv("DUMP_FUZZER_STATS");
28 const bool kDumpNativeInput = getenv("LPM_DUMP_NATIVE_INPUT");
29 };
30
31 // This fuzzer checks that parsing a JSON list to a HostCache and then
32 // re-serializing it recreates the original JSON list.
33 //
34 // A side effect of this technique is that our distribution of HostCaches only
35 // contains HostCaches that can be generated by RestoreFromListValue. It's
36 // conceivable that this doesn't capture all possible HostCaches.
37 //
38 // TODO(dmcardle): Check the other direction of this property. Starting from an
39 // arbitrary HostCache, serialize it and then parse a different HostCache.
40 // Verify that the two HostCaches are equal.
DEFINE_PROTO_FUZZER(const host_cache_fuzzer_proto::JsonOrBytes & input)41 DEFINE_PROTO_FUZZER(const host_cache_fuzzer_proto::JsonOrBytes& input) {
42 static Environment env;
43
44 // Clamp these counters to avoid incorrect statistics in case of overflow. On
45 // platforms with 8-byte size_t, it would take roughly 58,000 centuries to
46 // overflow, assuming a very fast fuzzer running at 100,000 exec/s. However, a
47 // 4-byte size_t could overflow in roughly 12 hours.
48 static base::ClampedNumeric<size_t> valid_json_count = 0;
49 static base::ClampedNumeric<size_t> iteration_count = 0;
50
51 constexpr size_t kIterationsPerStatsDump = 1024;
52 static_assert(SIZE_MAX % kIterationsPerStatsDump != 0,
53 "After saturation, stats would print on every iteration.");
54
55 ++iteration_count;
56 if (env.kDumpStats && iteration_count % kIterationsPerStatsDump == 0) {
57 LOG(INFO) << "Valid JSON hit rate:" << valid_json_count << "/"
58 << iteration_count;
59 }
60
61 std::string native_input;
62 if (input.has_json()) {
63 json_proto::JsonProtoConverter converter;
64 native_input = converter.Convert(input.json());
65 } else if (input.has_bytes()) {
66 native_input = input.bytes();
67 } else {
68 return;
69 }
70
71 if (env.kDumpNativeInput)
72 LOG(INFO) << "native_input: " << native_input;
73
74 std::optional<base::Value> value = base::JSONReader::Read(native_input);
75 if (!value || !value->is_list())
76 return;
77 ++valid_json_count;
78
79 // Parse the HostCache.
80 constexpr size_t kMaxEntries = 1000;
81 HostCache host_cache(kMaxEntries);
82 if (!host_cache.RestoreFromListValue(value->GetList()))
83 return;
84
85 // Serialize the HostCache.
86 base::Value::List serialized;
87 host_cache.GetList(
88 serialized /* entry_list */, true /* include_staleness */,
89 HostCache::SerializationType::kRestorable /* serialization_type */);
90
91 CHECK_EQ(*value, serialized);
92 return;
93 }
94 } // namespace net
95