A simple fuzzer for HttpServer, with limited coverage of WebSocket.

net/server/http_server_fuzzer.cc

Index: net/server/http_server_fuzzer.cc
diff --git a/net/server/http_server_fuzzer.cc b/net/server/http_server_fuzzer.cc
new file mode 100644
index 0000000000000000000000000000000000000000..e23c9fb8a7de9e9649909622186588c927b0e210
--- /dev/null
+++ b/net/server/http_server_fuzzer.cc
@@ -0,0 +1,68 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/memory/ptr_util.h"
+#include "base/test/fuzzed_data_provider.h"
+#include "net/base/test_completion_callback.h"
+#include "net/log/test_net_log.h"
+#include "net/server/http_server.h"
+#include "net/socket/fuzzed_server_socket.h"
+
+namespace {
+
+class WaitTillHttpCloseDelegate : public net::HttpServer::Delegate {
+ public:
+  WaitTillHttpCloseDelegate(base::FuzzedDataProvider* data_provider,
+                            const net::CompletionCallback& callback)
+      : server_(nullptr), data_provider_(data_provider), callback_(callback) {
+    should_accept_webp_ = data_provider_->ConsumeBool();

[mmenke, 2017/01/24 16:29:16]

This variable name is confusing.  webp is the name of an image format.
should_accept_web_socket_?

[Maks Orlovich, 2017/01/24 18:34:18]

Err, yeah. My past life shining through.

+  }
+
+  void set_server(net::HttpServer* server) { server_ = server; }
+
+  void OnConnect(int connection_id) override {}

[mmenke, 2017/01/24 16:29:16]

Randomly close the socket or not here?

[Maks Orlovich, 2017/01/25 14:54:37]

Done.

+  void OnHttpRequest(int connection_id,
+                     const net::HttpServerRequestInfo& info) override {}

[mmenke, 2017/01/24 16:29:16]

Should we randomly write data or close the connection here?

[mmenke, 2017/01/24 19:43:58]

(Also, may want to do this multiple times, and synchronously and asynchronously)

[Maks Orlovich, 2017/01/25 14:54:37]

Done.

+
+  void OnWebSocketRequest(int connection_id,
+                          const net::HttpServerRequestInfo& info) override {
+    // Randomize whether the delegate accepts web socket or not, to cover both
+    // options.
+    if (should_accept_webp_)
+      server_->AcceptWebSocket(connection_id, info);
+  }
+
+  void OnWebSocketMessage(int connection_id, const std::string& data) override {

[mmenke, 2017/01/24 16:29:16]

Should we randomly write data or close the connection here?

[Maks Orlovich, 2017/01/25 14:54:37]

Done.

+  }
+  void OnClose(int connection_id) override { callback_.Run(net::OK); }

[mmenke, 2017/01/24 19:43:58]

Why is the socket guaranteed to be closed?

+
+ private:
+  net::HttpServer* server_;
+  base::FuzzedDataProvider* data_provider_;

[mmenke, 2017/01/24 16:29:16]

nit:

base::FuzzedDataProvider* const

(Meaning the address pointed at don't change).

[Maks Orlovich, 2017/01/24 18:34:18]

Done.

+  net::CompletionCallback callback_;
+  bool should_accept_webp_;

[mmenke, 2017/01/24 16:29:16]

add this to the initializer list and make it a const?

[mmenke, 2017/01/24 16:29:16]

DISALLOW_COPY_AND_ASSIGN + include base/macros.h

[Maks Orlovich, 2017/01/24 18:34:18]

Done.

+};
+
+}  // namespace
+
+// Fuzzer for HttpServer
+//
+// |data| is used to create a FuzzedServerSocket.
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  net::BoundTestNetLog bound_test_net_log;

[mmenke, 2017/01/24 16:29:16]

Should just be using TestNetLog (Then don't need the bound().net_log() stuff,
can just pass in its address directly)

[Maks Orlovich, 2017/01/25 14:54:37]

Done.

+  base::FuzzedDataProvider data_provider(data, size);
+
+  std::unique_ptr<net::ServerSocket> server_socket(
+      base::MakeUnique<net::FuzzedServerSocket>(
+          &data_provider, bound_test_net_log.bound().net_log()));
+  CHECK_EQ(net::OK,

[mmenke, 2017/01/24 16:29:16]

include net/base/net_errors.h and base/logging.h

[Maks Orlovich, 2017/01/25 14:54:37]

Done.

+           server_socket->ListenWithAddressAndPort("127.0.0.1", 80, 5));
+
+  net::TestCompletionCallback callback;  // provides the message loop

[mmenke, 2017/01/24 16:29:16]

The comment isn't correct.  It can spin the message loop, but the message loop
itself comes from net/base/fuzzer_test_support.cc.

[Maks Orlovich, 2017/01/25 14:54:37]

Spinning is what I meant; the sloppy comment is because not doing it was one of
the first things I did wrong; but at any rate w/RunLoop, as you suggested below,
its significance is clear.

+  WaitTillHttpCloseDelegate delegate(&data_provider, callback.callback());
+  net::HttpServer server(std::move(server_socket), &delegate);
+  delegate.set_server(&server);
+  CHECK_EQ(net::OK, callback.WaitForResult());

[mmenke, 2017/01/24 16:29:16]

Why check the result?

Also, I don't think we really get anything from using a TestCompletionCallback,
instead of just using a RunLoop directly.

[Maks Orlovich, 2017/01/25 14:54:37]

Switched to RunLoop --- which made the result issue moot.

+  return 0;
+}