Add dictionary for HTTP fuzzers.

net/data/http/http.dict

Index: net/data/http/http.dict
diff --git a/net/data/http/http.dict b/net/data/http/http.dict
new file mode 100644
index 0000000000000000000000000000000000000000..9d9bbed9ee40d9c0e63f235514f9ac3b4ea420f7
--- /dev/null
+++ b/net/data/http/http.dict
@@ -0,0 +1,76 @@
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Fuzzer dictionary targetting HTTP/1.x responses.
+
+# Entries that are generally useful in headers
+":"
+"\x0A"
+"\x0D"
+"0"
+"50"
+"500"
+# Horizontal whitespace. Matters mostly in status line.
+" "
+"\x09"

[eroman, 2016/04/18 17:26:24]

Does the format support regular C escape sequences like \t  and \r etc? Those
would be more readable IMO.

Another combined sequence that is interesting is 

CR LF TAB

For header line continuations.

Redundant though since can be produces from the smaller substrings already
given.

[mmenke, 2016/04/18 17:36:03]

Unfortunately, it does not, except for \" and \\
Added.  They're funky enough that I think it's worth adding.

+# Used in a lot of individual headers
+";"
+"="
+","
+"\""
+
+# Status line components
+"HTTP"
+"/1.1"
+"/1.0"
+# More interesting status codes.  Leading space so can be inserted into
+# other status lines.
+" 100"
+" 200"
+" 206"
+" 301"
+" 302"
+" 303"
+" 304"
+" 307"
+" 308"
+" 401"
+" 403"
+" 404"
+" 500"
+" 501"
+" 403"
+
+# Full status lines (Some with relevant following headers)
+"HTTP/1.1 200 OK\x0A\x0A"
+"HTTP/1.1 100 Continue\x0A\x0A"
+"HTTP/1.1 401 Unauthorized\x0AWWW-Authenticate: Basic realm=\"Middle-Earth\"\x0A\xA0"
+"HTTP/1.1 407 Proxy Authentication Required\x0AProxy-Authenticate: Digest realm=\"Middle-Earth\", nonce=\"aaaaaaaaaa\"\x0A\x0A"
+"HTTP/1.0 301 Moved Permanently\x0ALocation: /a\x0A\x0A"
+"HTTP/1.1 302 Found\x0ALocation: http://lost/\x0A\x0A"

[mmenke, 2016/04/18 16:35:46]

https://bugs.chromium.org/p/chromium/issues/detail?id=603964#c7 had some
discussions on the choice of shorter strings, more integration-y strings, or
both.

+
+# Proxy authentication headers. Note that fuzzers don't support NTLM or
+# negotiate.
+"WWW-Authenticate"
+"Proxy-Authenticate"
+"Basic"
+"Digest"
+"realm"
+"nonce"
+
+"Connection"
+"Proxy-Connection"
+"Keep-Alive"
+"Close"
+"\x0AConnection: Keep-Alive"
+"\x0AConnection: Close"
+"\x0AProxy-Connection: Keep-Alive"
+"\x0AProxy-Connection: Close"
+
+"Content-Length"
+"Transfer-Encoding"
+"chunked"
+"\x0AContent-Length: 0"
+"\x0AContent-Length: 500"
+"\x0ATransfer-Encoding: chunked\x0A\x0A5\x0A12345\x0A0\x0A\x0A"