1 // Copyright 2017 The Chromium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include <fuzzer/FuzzedDataProvider.h>
6
7 #include "base/check_op.h"
8 #include "base/memory/raw_ptr.h"
9 #include "base/run_loop.h"
10 #include "net/base/net_errors.h"
11 #include "net/log/net_log.h"
12 #include "net/log/test_net_log.h"
13 #include "net/server/http_server.h"
14 #include "net/socket/fuzzed_server_socket.h"
15 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
16
17 namespace {
18
19 class WaitTillHttpCloseDelegate : public net::HttpServer::Delegate {
20 public:
WaitTillHttpCloseDelegate(FuzzedDataProvider * data_provider,base::OnceClosure done_closure)21 WaitTillHttpCloseDelegate(FuzzedDataProvider* data_provider,
22 base::OnceClosure done_closure)
23 : data_provider_(data_provider),
24 done_closure_(std::move(done_closure)),
25 action_flags_(data_provider_->ConsumeIntegral<uint8_t>()) {}
26
27 WaitTillHttpCloseDelegate(const WaitTillHttpCloseDelegate&) = delete;
28 WaitTillHttpCloseDelegate& operator=(const WaitTillHttpCloseDelegate&) =
29 delete;
30
set_server(net::HttpServer * server)31 void set_server(net::HttpServer* server) { server_ = server; }
32
OnConnect(int connection_id)33 void OnConnect(int connection_id) override {
34 if (!(action_flags_ & ACCEPT_CONNECTION))
35 server_->Close(connection_id);
36 }
37
OnHttpRequest(int connection_id,const net::HttpServerRequestInfo & info)38 void OnHttpRequest(int connection_id,
39 const net::HttpServerRequestInfo& info) override {
40 if (!(action_flags_ & ACCEPT_MESSAGE)) {
41 server_->Close(connection_id);
42 return;
43 }
44
45 if (action_flags_ & REPLY_TO_MESSAGE) {
46 server_->Send200(connection_id,
47 data_provider_->ConsumeRandomLengthString(64),
48 "text/html", TRAFFIC_ANNOTATION_FOR_TESTS);
49 }
50 }
51
OnWebSocketRequest(int connection_id,const net::HttpServerRequestInfo & info)52 void OnWebSocketRequest(int connection_id,
53 const net::HttpServerRequestInfo& info) override {
54 if (action_flags_ & CLOSE_WEBSOCKET_RATHER_THAN_ACCEPT) {
55 server_->Close(connection_id);
56 return;
57 }
58
59 if (action_flags_ & ACCEPT_WEBSOCKET)
60 server_->AcceptWebSocket(connection_id, info,
61 TRAFFIC_ANNOTATION_FOR_TESTS);
62 }
63
OnWebSocketMessage(int connection_id,std::string data)64 void OnWebSocketMessage(int connection_id, std::string data) override {
65 if (!(action_flags_ & ACCEPT_MESSAGE)) {
66 server_->Close(connection_id);
67 return;
68 }
69
70 if (action_flags_ & REPLY_TO_MESSAGE) {
71 server_->SendOverWebSocket(connection_id,
72 data_provider_->ConsumeRandomLengthString(64),
73 TRAFFIC_ANNOTATION_FOR_TESTS);
74 }
75 }
76
OnClose(int connection_id)77 void OnClose(int connection_id) override {
78 // In general, OnClose can be called more than once, but FuzzedServerSocket
79 // only makes one connection, and it is the only socket of interest here.
80 std::move(done_closure_).Run();
81 }
82
83 private:
84 enum {
85 ACCEPT_CONNECTION = 1,
86 ACCEPT_MESSAGE = 2,
87 REPLY_TO_MESSAGE = 4,
88 ACCEPT_WEBSOCKET = 8,
89 CLOSE_WEBSOCKET_RATHER_THAN_ACCEPT = 16
90 };
91
92 raw_ptr<net::HttpServer> server_ = nullptr;
93 const raw_ptr<FuzzedDataProvider> data_provider_;
94 base::OnceClosure done_closure_;
95 const uint8_t action_flags_;
96 };
97
98 } // namespace
99
100 // Fuzzer for HttpServer
101 //
102 // |data| is used to create a FuzzedServerSocket.
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)103 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
104 // Including an observer; even though the recorded results aren't currently
105 // used, it'll ensure the netlogging code is fuzzed as well.
106 net::RecordingNetLogObserver net_log_observer;
107 FuzzedDataProvider data_provider(data, size);
108
109 std::unique_ptr<net::ServerSocket> server_socket(
110 std::make_unique<net::FuzzedServerSocket>(&data_provider,
111 net::NetLog::Get()));
112 CHECK_EQ(net::OK,
113 server_socket->ListenWithAddressAndPort("127.0.0.1", 80, 5));
114
115 base::RunLoop run_loop;
116 WaitTillHttpCloseDelegate delegate(&data_provider, run_loop.QuitClosure());
117 net::HttpServer server(std::move(server_socket), &delegate);
118 delegate.set_server(&server);
119 run_loop.Run();
120 return 0;
121 }
122