| OLD | NEW |
| 1 // Copyright 2016 The Chromium Authors. All rights reserved. | 1 // Copyright 2016 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/dns/fuzzed_host_resolver.h" | 5 #include "net/dns/fuzzed_host_resolver.h" |
| 6 | 6 |
| 7 #include <stdint.h> | 7 #include <stdint.h> |
| 8 | 8 |
| 9 #include <limits> | 9 #include <limits> |
| 10 #include <string> | 10 #include <string> |
| 11 | 11 |
| 12 #include "base/bind.h" | 12 #include "base/bind.h" |
| 13 #include "base/fuzzed_data_provider.h" |
| 13 #include "base/logging.h" | 14 #include "base/logging.h" |
| 14 #include "base/macros.h" | 15 #include "base/macros.h" |
| 15 #include "base/memory/ref_counted.h" | 16 #include "base/memory/ref_counted.h" |
| 16 #include "base/single_thread_task_runner.h" | 17 #include "base/single_thread_task_runner.h" |
| 17 #include "base/threading/thread_task_runner_handle.h" | 18 #include "base/threading/thread_task_runner_handle.h" |
| 18 #include "net/base/address_list.h" | 19 #include "net/base/address_list.h" |
| 19 #include "net/base/fuzzed_data_provider.h" | |
| 20 #include "net/base/ip_address.h" | 20 #include "net/base/ip_address.h" |
| 21 #include "net/base/ip_endpoint.h" | 21 #include "net/base/ip_endpoint.h" |
| 22 #include "net/base/net_errors.h" | 22 #include "net/base/net_errors.h" |
| 23 #include "net/dns/dns_client.h" | 23 #include "net/dns/dns_client.h" |
| 24 #include "net/dns/dns_config_service.h" | 24 #include "net/dns/dns_config_service.h" |
| 25 #include "net/dns/dns_hosts.h" | 25 #include "net/dns/dns_hosts.h" |
| 26 | 26 |
| 27 namespace net { | 27 namespace net { |
| 28 | 28 |
| 29 namespace { | 29 namespace { |
| 30 | 30 |
| 31 // Returns a fuzzed non-zero port number. | 31 // Returns a fuzzed non-zero port number. |
| 32 uint16_t FuzzPort(FuzzedDataProvider* data_provider) { | 32 uint16_t FuzzPort(base::FuzzedDataProvider* data_provider) { |
| 33 return data_provider->ConsumeUint16(); | 33 return data_provider->ConsumeUint16(); |
| 34 } | 34 } |
| 35 | 35 |
| 36 // Returns a fuzzed IPv4 address. Can return invalid / reserved addresses. | 36 // Returns a fuzzed IPv4 address. Can return invalid / reserved addresses. |
| 37 IPAddress FuzzIPv4Address(FuzzedDataProvider* data_provider) { | 37 IPAddress FuzzIPv4Address(base::FuzzedDataProvider* data_provider) { |
| 38 return IPAddress(data_provider->ConsumeUint8(), data_provider->ConsumeUint8(), | 38 return IPAddress(data_provider->ConsumeUint8(), data_provider->ConsumeUint8(), |
| 39 data_provider->ConsumeUint8(), | 39 data_provider->ConsumeUint8(), |
| 40 data_provider->ConsumeUint8()); | 40 data_provider->ConsumeUint8()); |
| 41 } | 41 } |
| 42 | 42 |
| 43 // Returns a fuzzed IPv6 address. Can return invalid / reserved addresses. | 43 // Returns a fuzzed IPv6 address. Can return invalid / reserved addresses. |
| 44 IPAddress FuzzIPv6Address(FuzzedDataProvider* data_provider) { | 44 IPAddress FuzzIPv6Address(base::FuzzedDataProvider* data_provider) { |
| 45 return IPAddress(data_provider->ConsumeUint8(), data_provider->ConsumeUint8(), | 45 return IPAddress(data_provider->ConsumeUint8(), data_provider->ConsumeUint8(), |
| 46 data_provider->ConsumeUint8(), data_provider->ConsumeUint8(), | 46 data_provider->ConsumeUint8(), data_provider->ConsumeUint8(), |
| 47 data_provider->ConsumeUint8(), data_provider->ConsumeUint8(), | 47 data_provider->ConsumeUint8(), data_provider->ConsumeUint8(), |
| 48 data_provider->ConsumeUint8(), data_provider->ConsumeUint8(), | 48 data_provider->ConsumeUint8(), data_provider->ConsumeUint8(), |
| 49 data_provider->ConsumeUint8(), data_provider->ConsumeUint8(), | 49 data_provider->ConsumeUint8(), data_provider->ConsumeUint8(), |
| 50 data_provider->ConsumeUint8(), data_provider->ConsumeUint8(), | 50 data_provider->ConsumeUint8(), data_provider->ConsumeUint8(), |
| 51 data_provider->ConsumeUint8(), data_provider->ConsumeUint8(), | 51 data_provider->ConsumeUint8(), data_provider->ConsumeUint8(), |
| 52 data_provider->ConsumeUint8(), | 52 data_provider->ConsumeUint8(), |
| 53 data_provider->ConsumeUint8()); | 53 data_provider->ConsumeUint8()); |
| 54 } | 54 } |
| 55 | 55 |
| 56 // Returns a fuzzed address, which can be either IPv4 or IPv6. Can return | 56 // Returns a fuzzed address, which can be either IPv4 or IPv6. Can return |
| 57 // invalid / reserved addresses. | 57 // invalid / reserved addresses. |
| 58 IPAddress FuzzIPAddress(FuzzedDataProvider* data_provider) { | 58 IPAddress FuzzIPAddress(base::FuzzedDataProvider* data_provider) { |
| 59 if (data_provider->ConsumeBool()) | 59 if (data_provider->ConsumeBool()) |
| 60 return FuzzIPv4Address(data_provider); | 60 return FuzzIPv4Address(data_provider); |
| 61 return FuzzIPv6Address(data_provider); | 61 return FuzzIPv6Address(data_provider); |
| 62 } | 62 } |
| 63 | 63 |
| 64 // HostResolverProc that returns a random set of results, and can succeed or | 64 // HostResolverProc that returns a random set of results, and can succeed or |
| 65 // fail. Must only be run on the thread it's created on. | 65 // fail. Must only be run on the thread it's created on. |
| 66 class FuzzedHostResolverProc : public HostResolverProc { | 66 class FuzzedHostResolverProc : public HostResolverProc { |
| 67 public: | 67 public: |
| 68 // Can safely be used after the destruction of |data_provider|. This can | 68 // Can safely be used after the destruction of |data_provider|. This can |
| 69 // happen if a request is issued but the code never waits for the result | 69 // happen if a request is issued but the code never waits for the result |
| 70 // before the test ends. | 70 // before the test ends. |
| 71 explicit FuzzedHostResolverProc( | 71 explicit FuzzedHostResolverProc( |
| 72 base::WeakPtr<FuzzedDataProvider> data_provider) | 72 base::WeakPtr<base::FuzzedDataProvider> data_provider) |
| 73 : HostResolverProc(nullptr), | 73 : HostResolverProc(nullptr), |
| 74 data_provider_(data_provider), | 74 data_provider_(data_provider), |
| 75 network_task_runner_(base::ThreadTaskRunnerHandle::Get()) {} | 75 network_task_runner_(base::ThreadTaskRunnerHandle::Get()) {} |
| 76 | 76 |
| 77 int Resolve(const std::string& host, | 77 int Resolve(const std::string& host, |
| 78 AddressFamily address_family, | 78 AddressFamily address_family, |
| 79 HostResolverFlags host_resolver_flags, | 79 HostResolverFlags host_resolver_flags, |
| 80 AddressList* addrlist, | 80 AddressList* addrlist, |
| 81 int* os_error) override { | 81 int* os_error) override { |
| 82 DCHECK(network_task_runner_->BelongsToCurrentThread()); | 82 DCHECK(network_task_runner_->BelongsToCurrentThread()); |
| (...skipping 37 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 120 result.set_canonical_name("foo.com"); | 120 result.set_canonical_name("foo.com"); |
| 121 } | 121 } |
| 122 | 122 |
| 123 *addrlist = result; | 123 *addrlist = result; |
| 124 return OK; | 124 return OK; |
| 125 } | 125 } |
| 126 | 126 |
| 127 private: | 127 private: |
| 128 ~FuzzedHostResolverProc() override {} | 128 ~FuzzedHostResolverProc() override {} |
| 129 | 129 |
| 130 base::WeakPtr<FuzzedDataProvider> data_provider_; | 130 base::WeakPtr<base::FuzzedDataProvider> data_provider_; |
| 131 | 131 |
| 132 // Just used for thread-safety checks. | 132 // Just used for thread-safety checks. |
| 133 scoped_refptr<base::SingleThreadTaskRunner> network_task_runner_; | 133 scoped_refptr<base::SingleThreadTaskRunner> network_task_runner_; |
| 134 | 134 |
| 135 DISALLOW_COPY_AND_ASSIGN(FuzzedHostResolverProc); | 135 DISALLOW_COPY_AND_ASSIGN(FuzzedHostResolverProc); |
| 136 }; | 136 }; |
| 137 | 137 |
| 138 } // namespace | 138 } // namespace |
| 139 | 139 |
| 140 FuzzedHostResolver::FuzzedHostResolver(const Options& options, | 140 FuzzedHostResolver::FuzzedHostResolver(const Options& options, |
| 141 NetLog* net_log, | 141 NetLog* net_log, |
| 142 FuzzedDataProvider* data_provider) | 142 base::FuzzedDataProvider* data_provider) |
| 143 : HostResolverImpl(options, net_log, base::ThreadTaskRunnerHandle::Get()), | 143 : HostResolverImpl(options, net_log, base::ThreadTaskRunnerHandle::Get()), |
| 144 data_provider_(data_provider), | 144 data_provider_(data_provider), |
| 145 socket_factory_(data_provider), | 145 socket_factory_(data_provider), |
| 146 is_ipv6_reachable_(data_provider->ConsumeBool()), | 146 is_ipv6_reachable_(data_provider->ConsumeBool()), |
| 147 net_log_(net_log), | 147 net_log_(net_log), |
| 148 data_provider_weak_factory_(data_provider) { | 148 data_provider_weak_factory_(data_provider) { |
| 149 HostResolverImpl::ProcTaskParams proc_task_params( | 149 HostResolverImpl::ProcTaskParams proc_task_params( |
| 150 new FuzzedHostResolverProc(data_provider_weak_factory_.GetWeakPtr()), | 150 new FuzzedHostResolverProc(data_provider_weak_factory_.GetWeakPtr()), |
| 151 // Retries are only used when the original request hangs, which this class | 151 // Retries are only used when the original request hangs, which this class |
| 152 // currently can't simulate. | 152 // currently can't simulate. |
| (...skipping 57 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 210 | 210 |
| 211 config.rotate = data_provider_->ConsumeBool(); | 211 config.rotate = data_provider_->ConsumeBool(); |
| 212 | 212 |
| 213 // Doesn't currently seem to do anything. | 213 // Doesn't currently seem to do anything. |
| 214 config.edns0 = false; | 214 config.edns0 = false; |
| 215 | 215 |
| 216 config.use_local_ipv6 = data_provider_->ConsumeBool(); | 216 config.use_local_ipv6 = data_provider_->ConsumeBool(); |
| 217 | 217 |
| 218 std::unique_ptr<DnsClient> dns_client = DnsClient::CreateClientForTesting( | 218 std::unique_ptr<DnsClient> dns_client = DnsClient::CreateClientForTesting( |
| 219 net_log_, &socket_factory_, | 219 net_log_, &socket_factory_, |
| 220 base::Bind(&FuzzedDataProvider::ConsumeInt32InRange, | 220 base::Bind(&base::FuzzedDataProvider::ConsumeInt32InRange, |
| 221 base::Unretained(data_provider_))); | 221 base::Unretained(data_provider_))); |
| 222 dns_client->SetConfig(config); | 222 dns_client->SetConfig(config); |
| 223 SetDnsClient(std::move(dns_client)); | 223 SetDnsClient(std::move(dns_client)); |
| 224 } | 224 } |
| 225 | 225 |
| 226 bool FuzzedHostResolver::IsIPv6Reachable(const BoundNetLog& net_log) { | 226 bool FuzzedHostResolver::IsIPv6Reachable(const BoundNetLog& net_log) { |
| 227 return is_ipv6_reachable_; | 227 return is_ipv6_reachable_; |
| 228 } | 228 } |
| 229 | 229 |
| 230 void FuzzedHostResolver::RunLoopbackProbeJob() { | 230 void FuzzedHostResolver::RunLoopbackProbeJob() { |
| 231 SetHaveOnlyLoopbackAddresses(data_provider_->ConsumeBool()); | 231 SetHaveOnlyLoopbackAddresses(data_provider_->ConsumeBool()); |
| 232 } | 232 } |
| 233 | 233 |
| 234 } // namespace net | 234 } // namespace net |
| OLD | NEW |