OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <algorithm> | 5 #include <algorithm> |
6 #include <iostream> | 6 #include <iostream> |
7 #include <limits> | 7 #include <limits> |
8 | 8 |
9 #include "base/compiler_specific.h" | 9 #include "base/compiler_specific.h" |
10 #include "base/memory/scoped_ptr.h" | 10 #include "base/memory/scoped_ptr.h" |
(...skipping 3036 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
3047 framer.set_enable_compression(false); | 3047 framer.set_enable_compression(false); |
3048 SpdySynStreamIR syn_stream(1); | 3048 SpdySynStreamIR syn_stream(1); |
3049 syn_stream.set_priority(1); | 3049 syn_stream.set_priority(1); |
3050 syn_stream.SetHeader("aa", ""); | 3050 syn_stream.SetHeader("aa", ""); |
3051 scoped_ptr<SpdyFrame> control_frame(framer.SerializeSynStream(syn_stream)); | 3051 scoped_ptr<SpdyFrame> control_frame(framer.SerializeSynStream(syn_stream)); |
3052 const size_t kBigValueSize = | 3052 const size_t kBigValueSize = |
3053 framer.GetControlFrameBufferMaxSize() - control_frame->size(); | 3053 framer.GetControlFrameBufferMaxSize() - control_frame->size(); |
3054 | 3054 |
3055 // Create a frame at exactly that size. | 3055 // Create a frame at exactly that size. |
3056 string big_value(kBigValueSize, 'x'); | 3056 string big_value(kBigValueSize, 'x'); |
3057 syn_stream.SetHeader("aa", big_value.c_str()); | 3057 syn_stream.SetHeader("aa", big_value); |
3058 control_frame.reset(framer.SerializeSynStream(syn_stream)); | 3058 control_frame.reset(framer.SerializeSynStream(syn_stream)); |
3059 EXPECT_TRUE(control_frame.get() != NULL); | 3059 EXPECT_TRUE(control_frame.get() != NULL); |
3060 EXPECT_EQ(framer.GetControlFrameBufferMaxSize(), control_frame->size()); | 3060 EXPECT_EQ(framer.GetControlFrameBufferMaxSize(), control_frame->size()); |
3061 | 3061 |
3062 TestSpdyVisitor visitor(spdy_version_); | 3062 TestSpdyVisitor visitor(spdy_version_); |
3063 visitor.SimulateInFramer( | 3063 visitor.SimulateInFramer( |
3064 reinterpret_cast<unsigned char*>(control_frame->data()), | 3064 reinterpret_cast<unsigned char*>(control_frame->data()), |
3065 control_frame->size()); | 3065 control_frame->size()); |
3066 EXPECT_TRUE(visitor.header_buffer_valid_); | 3066 EXPECT_TRUE(visitor.header_buffer_valid_); |
3067 EXPECT_EQ(0, visitor.error_count_); | 3067 EXPECT_EQ(0, visitor.error_count_); |
(...skipping 14 matching lines...) Expand all Loading... |
3082 framer.set_enable_compression(false); | 3082 framer.set_enable_compression(false); |
3083 SpdySynStreamIR syn_stream(1); | 3083 SpdySynStreamIR syn_stream(1); |
3084 syn_stream.SetHeader("aa", ""); | 3084 syn_stream.SetHeader("aa", ""); |
3085 syn_stream.set_priority(1); | 3085 syn_stream.set_priority(1); |
3086 scoped_ptr<SpdyFrame> control_frame(framer.SerializeSynStream(syn_stream)); | 3086 scoped_ptr<SpdyFrame> control_frame(framer.SerializeSynStream(syn_stream)); |
3087 const size_t kBigValueSize = | 3087 const size_t kBigValueSize = |
3088 framer.GetControlFrameBufferMaxSize() - control_frame->size() + 1; | 3088 framer.GetControlFrameBufferMaxSize() - control_frame->size() + 1; |
3089 | 3089 |
3090 // Create a frame at exatly that size. | 3090 // Create a frame at exatly that size. |
3091 string big_value(kBigValueSize, 'x'); | 3091 string big_value(kBigValueSize, 'x'); |
3092 syn_stream.SetHeader("aa", big_value.c_str()); | 3092 syn_stream.SetHeader("aa", big_value); |
3093 // Upstream branches here and wraps SPDY4 with EXPECT_DEBUG_DFATAL. We | 3093 // Upstream branches here and wraps SPDY4 with EXPECT_DEBUG_DFATAL. We |
3094 // neither support that in Chromium, nor do we use the same DFATAL (see | 3094 // neither support that in Chromium, nor do we use the same DFATAL (see |
3095 // SpdyFrameBuilder::WriteFramePrefix()). | 3095 // SpdyFrameBuilder::WriteFramePrefix()). |
3096 control_frame.reset(framer.SerializeSynStream(syn_stream)); | 3096 control_frame.reset(framer.SerializeSynStream(syn_stream)); |
3097 | 3097 |
3098 EXPECT_TRUE(control_frame.get() != NULL); | 3098 EXPECT_TRUE(control_frame.get() != NULL); |
3099 EXPECT_EQ(framer.GetControlFrameBufferMaxSize() + 1, | 3099 EXPECT_EQ(framer.GetControlFrameBufferMaxSize() + 1, |
3100 control_frame->size()); | 3100 control_frame->size()); |
3101 | 3101 |
3102 TestSpdyVisitor visitor(spdy_version_); | 3102 TestSpdyVisitor visitor(spdy_version_); |
(...skipping 14 matching lines...) Expand all Loading... |
3117 return; | 3117 return; |
3118 } | 3118 } |
3119 SpdyFramer framer(spdy_version_); | 3119 SpdyFramer framer(spdy_version_); |
3120 framer.set_enable_compression(false); | 3120 framer.set_enable_compression(false); |
3121 SpdyHeadersIR headers(1); | 3121 SpdyHeadersIR headers(1); |
3122 | 3122 |
3123 // Exact payload length will change with HPACK, but this should be long | 3123 // Exact payload length will change with HPACK, but this should be long |
3124 // enough to cause an overflow. | 3124 // enough to cause an overflow. |
3125 const size_t kBigValueSize = framer.GetControlFrameBufferMaxSize(); | 3125 const size_t kBigValueSize = framer.GetControlFrameBufferMaxSize(); |
3126 string big_value(kBigValueSize, 'x'); | 3126 string big_value(kBigValueSize, 'x'); |
3127 headers.SetHeader("aa", big_value.c_str()); | 3127 headers.SetHeader("aa", big_value); |
3128 scoped_ptr<SpdyFrame> control_frame(framer.SerializeHeaders(headers)); | 3128 scoped_ptr<SpdyFrame> control_frame(framer.SerializeHeaders(headers)); |
3129 EXPECT_TRUE(control_frame.get() != NULL); | 3129 EXPECT_TRUE(control_frame.get() != NULL); |
3130 EXPECT_GT(control_frame->size(), framer.GetControlFrameBufferMaxSize()); | 3130 EXPECT_GT(control_frame->size(), framer.GetControlFrameBufferMaxSize()); |
3131 | 3131 |
3132 TestSpdyVisitor visitor(spdy_version_); | 3132 TestSpdyVisitor visitor(spdy_version_); |
3133 visitor.SimulateInFramer( | 3133 visitor.SimulateInFramer( |
3134 reinterpret_cast<unsigned char*>(control_frame->data()), | 3134 reinterpret_cast<unsigned char*>(control_frame->data()), |
3135 control_frame->size()); | 3135 control_frame->size()); |
3136 EXPECT_TRUE(visitor.header_buffer_valid_); | 3136 EXPECT_TRUE(visitor.header_buffer_valid_); |
3137 EXPECT_EQ(0, visitor.error_count_); | 3137 EXPECT_EQ(0, visitor.error_count_); |
3138 EXPECT_EQ(1, visitor.headers_frame_count_); | 3138 EXPECT_EQ(1, visitor.headers_frame_count_); |
3139 EXPECT_EQ(1, visitor.continuation_count_); | 3139 EXPECT_EQ(1, visitor.continuation_count_); |
3140 EXPECT_EQ(1, visitor.zero_length_control_frame_header_data_count_); | 3140 EXPECT_EQ(1, visitor.zero_length_control_frame_header_data_count_); |
3141 } | 3141 } |
3142 | 3142 |
3143 TEST_P(SpdyFramerTest, TooLargePushPromiseFrameUsesContinuation) { | 3143 TEST_P(SpdyFramerTest, TooLargePushPromiseFrameUsesContinuation) { |
3144 if (spdy_version_ < SPDY4) { | 3144 if (spdy_version_ < SPDY4) { |
3145 return; | 3145 return; |
3146 } | 3146 } |
3147 SpdyFramer framer(spdy_version_); | 3147 SpdyFramer framer(spdy_version_); |
3148 framer.set_enable_compression(false); | 3148 framer.set_enable_compression(false); |
3149 SpdyPushPromiseIR push_promise(1, 2); | 3149 SpdyPushPromiseIR push_promise(1, 2); |
3150 | 3150 |
3151 // Exact payload length will change with HPACK, but this should be long | 3151 // Exact payload length will change with HPACK, but this should be long |
3152 // enough to cause an overflow. | 3152 // enough to cause an overflow. |
3153 const size_t kBigValueSize = framer.GetControlFrameBufferMaxSize(); | 3153 const size_t kBigValueSize = framer.GetControlFrameBufferMaxSize(); |
3154 string big_value(kBigValueSize, 'x'); | 3154 string big_value(kBigValueSize, 'x'); |
3155 push_promise.SetHeader("aa", big_value.c_str()); | 3155 push_promise.SetHeader("aa", big_value); |
3156 scoped_ptr<SpdyFrame> control_frame( | 3156 scoped_ptr<SpdyFrame> control_frame( |
3157 framer.SerializePushPromise(push_promise)); | 3157 framer.SerializePushPromise(push_promise)); |
3158 EXPECT_TRUE(control_frame.get() != NULL); | 3158 EXPECT_TRUE(control_frame.get() != NULL); |
3159 EXPECT_GT(control_frame->size(), framer.GetControlFrameBufferMaxSize()); | 3159 EXPECT_GT(control_frame->size(), framer.GetControlFrameBufferMaxSize()); |
3160 | 3160 |
3161 TestSpdyVisitor visitor(spdy_version_); | 3161 TestSpdyVisitor visitor(spdy_version_); |
3162 visitor.SimulateInFramer( | 3162 visitor.SimulateInFramer( |
3163 reinterpret_cast<unsigned char*>(control_frame->data()), | 3163 reinterpret_cast<unsigned char*>(control_frame->data()), |
3164 control_frame->size()); | 3164 control_frame->size()); |
3165 EXPECT_TRUE(visitor.header_buffer_valid_); | 3165 EXPECT_TRUE(visitor.header_buffer_valid_); |
3166 EXPECT_EQ(0, visitor.error_count_); | 3166 EXPECT_EQ(0, visitor.error_count_); |
3167 EXPECT_EQ(1, visitor.push_promise_frame_count_); | 3167 EXPECT_EQ(1, visitor.push_promise_frame_count_); |
3168 EXPECT_EQ(1, visitor.continuation_count_); | 3168 EXPECT_EQ(1, visitor.continuation_count_); |
3169 EXPECT_EQ(1, visitor.zero_length_control_frame_header_data_count_); | 3169 EXPECT_EQ(1, visitor.zero_length_control_frame_header_data_count_); |
3170 } | 3170 } |
3171 | 3171 |
3172 // Check that the framer stops delivering header data chunks once the visitor | 3172 // Check that the framer stops delivering header data chunks once the visitor |
3173 // declares it doesn't want any more. This is important to guard against | 3173 // declares it doesn't want any more. This is important to guard against |
3174 // "zip bomb" types of attacks. | 3174 // "zip bomb" types of attacks. |
3175 TEST_P(SpdyFramerTest, ControlFrameMuchTooLarge) { | 3175 TEST_P(SpdyFramerTest, ControlFrameMuchTooLarge) { |
3176 const size_t kHeaderBufferChunks = 4; | 3176 const size_t kHeaderBufferChunks = 4; |
3177 const size_t kHeaderBufferSize = | 3177 const size_t kHeaderBufferSize = |
3178 TestSpdyVisitor::header_data_chunk_max_size() * kHeaderBufferChunks; | 3178 TestSpdyVisitor::header_data_chunk_max_size() * kHeaderBufferChunks; |
3179 const size_t kBigValueSize = kHeaderBufferSize * 2; | 3179 const size_t kBigValueSize = kHeaderBufferSize * 2; |
3180 string big_value(kBigValueSize, 'x'); | 3180 string big_value(kBigValueSize, 'x'); |
3181 SpdyFramer framer(spdy_version_); | 3181 SpdyFramer framer(spdy_version_); |
3182 SpdySynStreamIR syn_stream(1); | 3182 SpdySynStreamIR syn_stream(1); |
3183 syn_stream.set_priority(1); | 3183 syn_stream.set_priority(1); |
3184 syn_stream.set_fin(true); | 3184 syn_stream.set_fin(true); |
3185 syn_stream.SetHeader("aa", big_value.c_str()); | 3185 syn_stream.SetHeader("aa", big_value); |
3186 scoped_ptr<SpdyFrame> control_frame(framer.SerializeSynStream(syn_stream)); | 3186 scoped_ptr<SpdyFrame> control_frame(framer.SerializeSynStream(syn_stream)); |
3187 EXPECT_TRUE(control_frame.get() != NULL); | 3187 EXPECT_TRUE(control_frame.get() != NULL); |
3188 TestSpdyVisitor visitor(spdy_version_); | 3188 TestSpdyVisitor visitor(spdy_version_); |
3189 visitor.set_header_buffer_size(kHeaderBufferSize); | 3189 visitor.set_header_buffer_size(kHeaderBufferSize); |
3190 visitor.use_compression_ = true; | 3190 visitor.use_compression_ = true; |
3191 visitor.SimulateInFramer( | 3191 visitor.SimulateInFramer( |
3192 reinterpret_cast<unsigned char*>(control_frame->data()), | 3192 reinterpret_cast<unsigned char*>(control_frame->data()), |
3193 control_frame->size()); | 3193 control_frame->size()); |
3194 EXPECT_FALSE(visitor.header_buffer_valid_); | 3194 EXPECT_FALSE(visitor.header_buffer_valid_); |
3195 EXPECT_EQ(1, visitor.error_count_); | 3195 EXPECT_EQ(1, visitor.error_count_); |
(...skipping 1757 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
4953 SpdyBlockedIR blocked_ir(0); | 4953 SpdyBlockedIR blocked_ir(0); |
4954 scoped_ptr<SpdySerializedFrame> frame(framer.SerializeFrame(blocked_ir)); | 4954 scoped_ptr<SpdySerializedFrame> frame(framer.SerializeFrame(blocked_ir)); |
4955 framer.ProcessInput(frame->data(), framer.GetBlockedSize()); | 4955 framer.ProcessInput(frame->data(), framer.GetBlockedSize()); |
4956 | 4956 |
4957 EXPECT_EQ(SpdyFramer::SPDY_RESET, framer.state()); | 4957 EXPECT_EQ(SpdyFramer::SPDY_RESET, framer.state()); |
4958 EXPECT_EQ(SpdyFramer::SPDY_NO_ERROR, framer.error_code()) | 4958 EXPECT_EQ(SpdyFramer::SPDY_NO_ERROR, framer.error_code()) |
4959 << SpdyFramer::ErrorCodeToString(framer.error_code()); | 4959 << SpdyFramer::ErrorCodeToString(framer.error_code()); |
4960 } | 4960 } |
4961 | 4961 |
4962 } // namespace net | 4962 } // namespace net |
OLD | NEW |