net: Add fuzzer for HostResolverImpl.

net/dns/fuzzed_host_resolver.cc

+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "net/dns/fuzzed_host_resolver.h"
+
+#include <stdint.h>
+
+#include <limits>
+#include <string>
+
+#include "base/bind.h"
+#include "base/logging.h"
+#include "base/macros.h"
+#include "base/memory/ref_counted.h"
+#include "base/single_thread_task_runner.h"
+#include "base/thread_task_runner_handle.h"
+#include "net/base/address_list.h"
+#include "net/base/fuzzed_data_provider.h"
+#include "net/base/ip_address.h"
+#include "net/base/ip_endpoint.h"
+#include "net/base/net_errors.h"
+#include "net/dns/dns_client.h"
+#include "net/dns/dns_config_service.h"
+#include "net/dns/dns_hosts.h"
+
+namespace net {
+
+namespace {
+
+// Returns a fuzzed non-zero port number.
+uint16_t FuzzPort(FuzzedDataProvider* data_provider) {
+  uint16_t port = data_provider->ConsumeUint16();
+  // Port 0 is magic.
+  if (port == 0)
+    return 53;
+  return port;
+}
+
+// Returns a fuzzed IPv4 address.  Can return invalid / reserved addresses.
+IPAddress FuzzIPv4Address(FuzzedDataProvider* data_provider) {
+  return IPAddress(data_provider->ConsumeUint8(), data_provider->ConsumeUint8(),
+                   data_provider->ConsumeUint8(),
+                   data_provider->ConsumeUint8());
+}
+
+// Returns a fuzzed IPv6 address.  Can return invalid / reserved addresses.
+IPAddress FuzzIPv6Address(FuzzedDataProvider* data_provider) {
+  return IPAddress(data_provider->ConsumeUint8(), data_provider->ConsumeUint8(),
+                   data_provider->ConsumeUint8(), data_provider->ConsumeUint8(),
+                   data_provider->ConsumeUint8(), data_provider->ConsumeUint8(),
+                   data_provider->ConsumeUint8(), data_provider->ConsumeUint8(),
+                   data_provider->ConsumeUint8(), data_provider->ConsumeUint8(),
+                   data_provider->ConsumeUint8(), data_provider->ConsumeUint8(),
+                   data_provider->ConsumeUint8(), data_provider->ConsumeUint8(),
+                   data_provider->ConsumeUint8(),
+                   data_provider->ConsumeUint8());
+}
+
+// Returns a fuzzed address, which can be either IPv4 or IPv6.  Can return
+// invalid / reserved addresses.
+IPAddress FuzzIPAddress(FuzzedDataProvider* data_provider) {
+  if (data_provider->ConsumeBool())
+    return FuzzIPv4Address(data_provider);
+  return FuzzIPv6Address(data_provider);
+}
+
+// HostResolverProc that returns a random set of results, and can succeed or
+// fail. Must only be run on the thread it's created on.
+class FuzzedHostResolverProc : public HostResolverProc {
+ public:
+  // Can safely be used after the destruction of |data_provider|. This can
+  // happen if a request is issued but the code never waits for the result
+  // before the test ends.
+  explicit FuzzedHostResolverProc(
+      base::WeakPtr<FuzzedDataProvider> data_provider)
+      : HostResolverProc(nullptr),
+        data_provider_(data_provider),
+        network_task_runner_(base::ThreadTaskRunnerHandle::Get()) {}
+
+  int Resolve(const std::string& host,
+              AddressFamily address_family,
+              HostResolverFlags host_resolver_flags,
+              AddressList* addrlist,
+              int* os_error) override {
+    DCHECK(network_task_runner_->BelongsToCurrentThread());
+
+    if (os_error)
+      *os_error = 0;
+
+    // If the data provider is no longer avaiable, just fail. The HostResolver
+    // has already been deleted by this point, anyways.
+    if (!data_provider_)
+      return ERR_FAILED;
+
+    AddressList result;
+
+    // Put IPv6 addresses before IPv4 ones. This code doesn't sort addresses
+    // correctly, but when sorted according to spec, IPv6 addresses are
+    // generally before IPv4 ones.
+    if (address_family == ADDRESS_FAMILY_UNSPECIFIED ||
+        address_family == ADDRESS_FAMILY_IPV6) {
+      while (data_provider_->ConsumeBool()) {

[eroman, 2016/05/17 23:01:34]

Is consuming bools here the best approach? (as opposed to consuming a
single-byte length).

[mmenke, 2016/05/19 19:09:45]

I went with this pattern for three reasons:

1)  More likely to return 0-size and 1-size sets of values, which are
particularly interesting, and more likely to result in the fuzzer finding valid
stuff.
2)  No arbitrary length limit (Though suppose limit on fuzz data length does
implicitly impose one).
3)  Most importantly, it saves one whole line of code!  I could count down
instead, but that seems less natural than counting up, to me.

I've switched all instances of this pattern.  I don't feel too strongly about
it.

+        result.push_back(
+            net::IPEndPoint(FuzzIPv6Address(data_provider_.get()), 0));
+      }
+    }
+
+    if (address_family == ADDRESS_FAMILY_UNSPECIFIED ||
+        address_family == ADDRESS_FAMILY_IPV4) {
+      while (data_provider_->ConsumeBool()) {

[eroman, 2016/05/17 23:01:33]

same question

[mmenke, 2016/05/19 19:09:45]

Done.

+        result.push_back(
+            net::IPEndPoint(FuzzIPv4Address(data_provider_.get()), 0));
+      }
+    }
+
+    if (result.empty())
+      return ERR_NAME_NOT_RESOLVED;
+
+    if (host_resolver_flags & HOST_RESOLVER_CANONNAME) {
+      // Don't bother to fuzz this - almost nothing cares.
+      result.set_canonical_name("foo.com");
+    }
+
+    *addrlist = result;
+    return OK;
+  }
+
+ private:
+  ~FuzzedHostResolverProc() override {}
+
+  base::WeakPtr<FuzzedDataProvider> data_provider_;
+
+  // Just used for thread-safety checks.
+  scoped_refptr<base::SingleThreadTaskRunner> network_task_runner_;
+
+  DISALLOW_COPY_AND_ASSIGN(FuzzedHostResolverProc);
+};
+
+}  // namespace
+
+FuzzedHostResolver::FuzzedHostResolver(const Options& options,
+                                       NetLog* net_log,
+                                       FuzzedDataProvider* data_provider)
+    : HostResolverImpl(options, net_log, base::ThreadTaskRunnerHandle::Get()),
+      data_provider_(data_provider),
+      socket_factory_(data_provider),
+      is_ipv6_reachable_(data_provider->ConsumeBool()),
+      net_log_(net_log),
+      data_provider_weak_factory_(data_provider) {
+  HostResolverImpl::ProcTaskParams proc_task_params(
+      new FuzzedHostResolverProc(data_provider_weak_factory_.GetWeakPtr()),
+      // Retries are only used when the original request hangs, which this class
+      // currently can't simulate.
+      0 /* max_retry_attempts */);
+  set_proc_params_for_test(proc_task_params);
+}
+
+FuzzedHostResolver::~FuzzedHostResolver() {}
+
+void FuzzedHostResolver::SetDnsClientEnabled(bool enabled) {
+  if (!enabled) {
+    HostResolverImpl::SetDnsClientEnabled(false);
+    return;
+  }
+
+  // Fuzz DNS configuration.
+
+  DnsConfig config;
+  // Determine the number of name servers.
+  while (data_provider_->ConsumeBool()) {

[eroman, 2016/05/17 23:01:34]

Same question throughout this file.

[mmenke, 2016/05/19 19:09:45]

Done.

+    config.nameservers.push_back(
+        IPEndPoint(FuzzIPAddress(data_provider_), FuzzPort(data_provider_)));
+  }
+
+  // Determine the number of suffixes to try. Each case deliberately falls
+  // through.
+  switch (data_provider_->ConsumeValueInRange(0, 3)) {
+    case 3:
+      config.search.push_back("foo.com");
+    case 2:
+      config.search.push_back("bar");
+    case 1:
+      config.search.push_back("com");
+    default:
+      break;
+  }
+
+  net::DnsHosts hosts;
+  // Fuzz hosts file.
+  while (data_provider_->ConsumeBool()) {
+    const char* kHostnames[] = {"foo", "foo.com",   "a.foo.com",
+                                "bar", "localhost", "localhost6"};
+    const char* hostname = kHostnames[data_provider_->ConsumeValueInRange(
+        0, arraysize(kHostnames) - 1)];
+    if (data_provider_->ConsumeBool()) {

[eroman, 2016/05/17 23:01:34]

nit: Suggest just calling FuzzIPAddress() instead. Then call
GetAddressFamily(ip_addr) to get the other needed param.

[mmenke, 2016/05/19 19:09:45]

Done.  I hadn't realized there was such a method - the fact that it's not a
method in IPAddress makes is not very discoverable.  I seem to remember some
code explicitly checking the length of an IPAddress to do this somewhere, which
just seemed ugly.

+      config.hosts[net::DnsHostsKey(hostname, net::ADDRESS_FAMILY_IPV4)] =
+          FuzzIPv4Address(data_provider_);
+    } else {
+      config.hosts[net::DnsHostsKey(hostname, net::ADDRESS_FAMILY_IPV6)] =
+          FuzzIPv6Address(data_provider_);
+    }
+  }
+
+  config.unhandled_options = data_provider_->ConsumeBool();
+  config.append_to_multi_label_name = data_provider_->ConsumeBool();
+  config.randomize_ports = data_provider_->ConsumeBool();
+  config.attempts = data_provider_->ConsumeValueInRange(1, 3);
+  config.ndots = data_provider_->ConsumeValueInRange(0, 3);
+
+  // Timeouts don't really work for fuzzing. Even a timeout of 0 milliseconds
+  // will be increased after the first timeout, resulting in inconsistent
+  // behavior.
+  config.timeout = base::TimeDelta::FromDays(10);
+
+  config.rotate = data_provider_->ConsumeBool();
+
+  // Doesn't currently seem to do anything.
+  config.edns0 = false;
+
+  config.use_local_ipv6 = data_provider_->ConsumeBool();
+
+  std::unique_ptr<DnsClient> dns_client = DnsClient::CreateClientForTesting(
+      net_log_, &socket_factory_,
+      base::Bind(&FuzzedDataProvider::ConsumeValueInRangeInt,
+                 base::Unretained(data_provider_)));
+  dns_client->SetConfig(config);
+  SetDnsClient(std::move(dns_client));
+}
+
+bool FuzzedHostResolver::IsIPv6Reachable(const BoundNetLog& net_log) {
+  return is_ipv6_reachable_;
+}
+
+void FuzzedHostResolver::RunLoopbackProbeJob() {
+  SetHaveOnlyLoopbackAddresses(data_provider_->ConsumeBool());
+}
+
+}  // namespace net