| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <algorithm> | 5 #include <algorithm> |
| 6 #include <iostream> | 6 #include <iostream> |
| 7 #include <limits> | 7 #include <limits> |
| 8 | 8 |
| 9 #include "base/compiler_specific.h" | 9 #include "base/compiler_specific.h" |
| 10 #include "base/memory/scoped_ptr.h" | 10 #include "base/memory/scoped_ptr.h" |
| (...skipping 3036 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 3047 framer.set_enable_compression(false); | 3047 framer.set_enable_compression(false); |
| 3048 SpdySynStreamIR syn_stream(1); | 3048 SpdySynStreamIR syn_stream(1); |
| 3049 syn_stream.set_priority(1); | 3049 syn_stream.set_priority(1); |
| 3050 syn_stream.SetHeader("aa", ""); | 3050 syn_stream.SetHeader("aa", ""); |
| 3051 scoped_ptr<SpdyFrame> control_frame(framer.SerializeSynStream(syn_stream)); | 3051 scoped_ptr<SpdyFrame> control_frame(framer.SerializeSynStream(syn_stream)); |
| 3052 const size_t kBigValueSize = | 3052 const size_t kBigValueSize = |
| 3053 framer.GetControlFrameBufferMaxSize() - control_frame->size(); | 3053 framer.GetControlFrameBufferMaxSize() - control_frame->size(); |
| 3054 | 3054 |
| 3055 // Create a frame at exactly that size. | 3055 // Create a frame at exactly that size. |
| 3056 string big_value(kBigValueSize, 'x'); | 3056 string big_value(kBigValueSize, 'x'); |
| 3057 syn_stream.SetHeader("aa", big_value.c_str()); | 3057 syn_stream.SetHeader("aa", big_value); |
| 3058 control_frame.reset(framer.SerializeSynStream(syn_stream)); | 3058 control_frame.reset(framer.SerializeSynStream(syn_stream)); |
| 3059 EXPECT_TRUE(control_frame.get() != NULL); | 3059 EXPECT_TRUE(control_frame.get() != NULL); |
| 3060 EXPECT_EQ(framer.GetControlFrameBufferMaxSize(), control_frame->size()); | 3060 EXPECT_EQ(framer.GetControlFrameBufferMaxSize(), control_frame->size()); |
| 3061 | 3061 |
| 3062 TestSpdyVisitor visitor(spdy_version_); | 3062 TestSpdyVisitor visitor(spdy_version_); |
| 3063 visitor.SimulateInFramer( | 3063 visitor.SimulateInFramer( |
| 3064 reinterpret_cast<unsigned char*>(control_frame->data()), | 3064 reinterpret_cast<unsigned char*>(control_frame->data()), |
| 3065 control_frame->size()); | 3065 control_frame->size()); |
| 3066 EXPECT_TRUE(visitor.header_buffer_valid_); | 3066 EXPECT_TRUE(visitor.header_buffer_valid_); |
| 3067 EXPECT_EQ(0, visitor.error_count_); | 3067 EXPECT_EQ(0, visitor.error_count_); |
| (...skipping 14 matching lines...) Expand all Loading... |
| 3082 framer.set_enable_compression(false); | 3082 framer.set_enable_compression(false); |
| 3083 SpdySynStreamIR syn_stream(1); | 3083 SpdySynStreamIR syn_stream(1); |
| 3084 syn_stream.SetHeader("aa", ""); | 3084 syn_stream.SetHeader("aa", ""); |
| 3085 syn_stream.set_priority(1); | 3085 syn_stream.set_priority(1); |
| 3086 scoped_ptr<SpdyFrame> control_frame(framer.SerializeSynStream(syn_stream)); | 3086 scoped_ptr<SpdyFrame> control_frame(framer.SerializeSynStream(syn_stream)); |
| 3087 const size_t kBigValueSize = | 3087 const size_t kBigValueSize = |
| 3088 framer.GetControlFrameBufferMaxSize() - control_frame->size() + 1; | 3088 framer.GetControlFrameBufferMaxSize() - control_frame->size() + 1; |
| 3089 | 3089 |
| 3090 // Create a frame at exatly that size. | 3090 // Create a frame at exatly that size. |
| 3091 string big_value(kBigValueSize, 'x'); | 3091 string big_value(kBigValueSize, 'x'); |
| 3092 syn_stream.SetHeader("aa", big_value.c_str()); | 3092 syn_stream.SetHeader("aa", big_value); |
| 3093 // Upstream branches here and wraps SPDY4 with EXPECT_DEBUG_DFATAL. We | 3093 // Upstream branches here and wraps SPDY4 with EXPECT_DEBUG_DFATAL. We |
| 3094 // neither support that in Chromium, nor do we use the same DFATAL (see | 3094 // neither support that in Chromium, nor do we use the same DFATAL (see |
| 3095 // SpdyFrameBuilder::WriteFramePrefix()). | 3095 // SpdyFrameBuilder::WriteFramePrefix()). |
| 3096 control_frame.reset(framer.SerializeSynStream(syn_stream)); | 3096 control_frame.reset(framer.SerializeSynStream(syn_stream)); |
| 3097 | 3097 |
| 3098 EXPECT_TRUE(control_frame.get() != NULL); | 3098 EXPECT_TRUE(control_frame.get() != NULL); |
| 3099 EXPECT_EQ(framer.GetControlFrameBufferMaxSize() + 1, | 3099 EXPECT_EQ(framer.GetControlFrameBufferMaxSize() + 1, |
| 3100 control_frame->size()); | 3100 control_frame->size()); |
| 3101 | 3101 |
| 3102 TestSpdyVisitor visitor(spdy_version_); | 3102 TestSpdyVisitor visitor(spdy_version_); |
| (...skipping 14 matching lines...) Expand all Loading... |
| 3117 return; | 3117 return; |
| 3118 } | 3118 } |
| 3119 SpdyFramer framer(spdy_version_); | 3119 SpdyFramer framer(spdy_version_); |
| 3120 framer.set_enable_compression(false); | 3120 framer.set_enable_compression(false); |
| 3121 SpdyHeadersIR headers(1); | 3121 SpdyHeadersIR headers(1); |
| 3122 | 3122 |
| 3123 // Exact payload length will change with HPACK, but this should be long | 3123 // Exact payload length will change with HPACK, but this should be long |
| 3124 // enough to cause an overflow. | 3124 // enough to cause an overflow. |
| 3125 const size_t kBigValueSize = framer.GetControlFrameBufferMaxSize(); | 3125 const size_t kBigValueSize = framer.GetControlFrameBufferMaxSize(); |
| 3126 string big_value(kBigValueSize, 'x'); | 3126 string big_value(kBigValueSize, 'x'); |
| 3127 headers.SetHeader("aa", big_value.c_str()); | 3127 headers.SetHeader("aa", big_value); |
| 3128 scoped_ptr<SpdyFrame> control_frame(framer.SerializeHeaders(headers)); | 3128 scoped_ptr<SpdyFrame> control_frame(framer.SerializeHeaders(headers)); |
| 3129 EXPECT_TRUE(control_frame.get() != NULL); | 3129 EXPECT_TRUE(control_frame.get() != NULL); |
| 3130 EXPECT_GT(control_frame->size(), framer.GetControlFrameBufferMaxSize()); | 3130 EXPECT_GT(control_frame->size(), framer.GetControlFrameBufferMaxSize()); |
| 3131 | 3131 |
| 3132 TestSpdyVisitor visitor(spdy_version_); | 3132 TestSpdyVisitor visitor(spdy_version_); |
| 3133 visitor.SimulateInFramer( | 3133 visitor.SimulateInFramer( |
| 3134 reinterpret_cast<unsigned char*>(control_frame->data()), | 3134 reinterpret_cast<unsigned char*>(control_frame->data()), |
| 3135 control_frame->size()); | 3135 control_frame->size()); |
| 3136 EXPECT_TRUE(visitor.header_buffer_valid_); | 3136 EXPECT_TRUE(visitor.header_buffer_valid_); |
| 3137 EXPECT_EQ(0, visitor.error_count_); | 3137 EXPECT_EQ(0, visitor.error_count_); |
| 3138 EXPECT_EQ(1, visitor.headers_frame_count_); | 3138 EXPECT_EQ(1, visitor.headers_frame_count_); |
| 3139 EXPECT_EQ(1, visitor.continuation_count_); | 3139 EXPECT_EQ(1, visitor.continuation_count_); |
| 3140 EXPECT_EQ(1, visitor.zero_length_control_frame_header_data_count_); | 3140 EXPECT_EQ(1, visitor.zero_length_control_frame_header_data_count_); |
| 3141 } | 3141 } |
| 3142 | 3142 |
| 3143 TEST_P(SpdyFramerTest, TooLargePushPromiseFrameUsesContinuation) { | 3143 TEST_P(SpdyFramerTest, TooLargePushPromiseFrameUsesContinuation) { |
| 3144 if (spdy_version_ < SPDY4) { | 3144 if (spdy_version_ < SPDY4) { |
| 3145 return; | 3145 return; |
| 3146 } | 3146 } |
| 3147 SpdyFramer framer(spdy_version_); | 3147 SpdyFramer framer(spdy_version_); |
| 3148 framer.set_enable_compression(false); | 3148 framer.set_enable_compression(false); |
| 3149 SpdyPushPromiseIR push_promise(1, 2); | 3149 SpdyPushPromiseIR push_promise(1, 2); |
| 3150 | 3150 |
| 3151 // Exact payload length will change with HPACK, but this should be long | 3151 // Exact payload length will change with HPACK, but this should be long |
| 3152 // enough to cause an overflow. | 3152 // enough to cause an overflow. |
| 3153 const size_t kBigValueSize = framer.GetControlFrameBufferMaxSize(); | 3153 const size_t kBigValueSize = framer.GetControlFrameBufferMaxSize(); |
| 3154 string big_value(kBigValueSize, 'x'); | 3154 string big_value(kBigValueSize, 'x'); |
| 3155 push_promise.SetHeader("aa", big_value.c_str()); | 3155 push_promise.SetHeader("aa", big_value); |
| 3156 scoped_ptr<SpdyFrame> control_frame( | 3156 scoped_ptr<SpdyFrame> control_frame( |
| 3157 framer.SerializePushPromise(push_promise)); | 3157 framer.SerializePushPromise(push_promise)); |
| 3158 EXPECT_TRUE(control_frame.get() != NULL); | 3158 EXPECT_TRUE(control_frame.get() != NULL); |
| 3159 EXPECT_GT(control_frame->size(), framer.GetControlFrameBufferMaxSize()); | 3159 EXPECT_GT(control_frame->size(), framer.GetControlFrameBufferMaxSize()); |
| 3160 | 3160 |
| 3161 TestSpdyVisitor visitor(spdy_version_); | 3161 TestSpdyVisitor visitor(spdy_version_); |
| 3162 visitor.SimulateInFramer( | 3162 visitor.SimulateInFramer( |
| 3163 reinterpret_cast<unsigned char*>(control_frame->data()), | 3163 reinterpret_cast<unsigned char*>(control_frame->data()), |
| 3164 control_frame->size()); | 3164 control_frame->size()); |
| 3165 EXPECT_TRUE(visitor.header_buffer_valid_); | 3165 EXPECT_TRUE(visitor.header_buffer_valid_); |
| 3166 EXPECT_EQ(0, visitor.error_count_); | 3166 EXPECT_EQ(0, visitor.error_count_); |
| 3167 EXPECT_EQ(1, visitor.push_promise_frame_count_); | 3167 EXPECT_EQ(1, visitor.push_promise_frame_count_); |
| 3168 EXPECT_EQ(1, visitor.continuation_count_); | 3168 EXPECT_EQ(1, visitor.continuation_count_); |
| 3169 EXPECT_EQ(1, visitor.zero_length_control_frame_header_data_count_); | 3169 EXPECT_EQ(1, visitor.zero_length_control_frame_header_data_count_); |
| 3170 } | 3170 } |
| 3171 | 3171 |
| 3172 // Check that the framer stops delivering header data chunks once the visitor | 3172 // Check that the framer stops delivering header data chunks once the visitor |
| 3173 // declares it doesn't want any more. This is important to guard against | 3173 // declares it doesn't want any more. This is important to guard against |
| 3174 // "zip bomb" types of attacks. | 3174 // "zip bomb" types of attacks. |
| 3175 TEST_P(SpdyFramerTest, ControlFrameMuchTooLarge) { | 3175 TEST_P(SpdyFramerTest, ControlFrameMuchTooLarge) { |
| 3176 const size_t kHeaderBufferChunks = 4; | 3176 const size_t kHeaderBufferChunks = 4; |
| 3177 const size_t kHeaderBufferSize = | 3177 const size_t kHeaderBufferSize = |
| 3178 TestSpdyVisitor::header_data_chunk_max_size() * kHeaderBufferChunks; | 3178 TestSpdyVisitor::header_data_chunk_max_size() * kHeaderBufferChunks; |
| 3179 const size_t kBigValueSize = kHeaderBufferSize * 2; | 3179 const size_t kBigValueSize = kHeaderBufferSize * 2; |
| 3180 string big_value(kBigValueSize, 'x'); | 3180 string big_value(kBigValueSize, 'x'); |
| 3181 SpdyFramer framer(spdy_version_); | 3181 SpdyFramer framer(spdy_version_); |
| 3182 SpdySynStreamIR syn_stream(1); | 3182 SpdySynStreamIR syn_stream(1); |
| 3183 syn_stream.set_priority(1); | 3183 syn_stream.set_priority(1); |
| 3184 syn_stream.set_fin(true); | 3184 syn_stream.set_fin(true); |
| 3185 syn_stream.SetHeader("aa", big_value.c_str()); | 3185 syn_stream.SetHeader("aa", big_value); |
| 3186 scoped_ptr<SpdyFrame> control_frame(framer.SerializeSynStream(syn_stream)); | 3186 scoped_ptr<SpdyFrame> control_frame(framer.SerializeSynStream(syn_stream)); |
| 3187 EXPECT_TRUE(control_frame.get() != NULL); | 3187 EXPECT_TRUE(control_frame.get() != NULL); |
| 3188 TestSpdyVisitor visitor(spdy_version_); | 3188 TestSpdyVisitor visitor(spdy_version_); |
| 3189 visitor.set_header_buffer_size(kHeaderBufferSize); | 3189 visitor.set_header_buffer_size(kHeaderBufferSize); |
| 3190 visitor.use_compression_ = true; | 3190 visitor.use_compression_ = true; |
| 3191 visitor.SimulateInFramer( | 3191 visitor.SimulateInFramer( |
| 3192 reinterpret_cast<unsigned char*>(control_frame->data()), | 3192 reinterpret_cast<unsigned char*>(control_frame->data()), |
| 3193 control_frame->size()); | 3193 control_frame->size()); |
| 3194 EXPECT_FALSE(visitor.header_buffer_valid_); | 3194 EXPECT_FALSE(visitor.header_buffer_valid_); |
| 3195 EXPECT_EQ(1, visitor.error_count_); | 3195 EXPECT_EQ(1, visitor.error_count_); |
| (...skipping 1757 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 4953 SpdyBlockedIR blocked_ir(0); | 4953 SpdyBlockedIR blocked_ir(0); |
| 4954 scoped_ptr<SpdySerializedFrame> frame(framer.SerializeFrame(blocked_ir)); | 4954 scoped_ptr<SpdySerializedFrame> frame(framer.SerializeFrame(blocked_ir)); |
| 4955 framer.ProcessInput(frame->data(), framer.GetBlockedSize()); | 4955 framer.ProcessInput(frame->data(), framer.GetBlockedSize()); |
| 4956 | 4956 |
| 4957 EXPECT_EQ(SpdyFramer::SPDY_RESET, framer.state()); | 4957 EXPECT_EQ(SpdyFramer::SPDY_RESET, framer.state()); |
| 4958 EXPECT_EQ(SpdyFramer::SPDY_NO_ERROR, framer.error_code()) | 4958 EXPECT_EQ(SpdyFramer::SPDY_NO_ERROR, framer.error_code()) |
| 4959 << SpdyFramer::ErrorCodeToString(framer.error_code()); | 4959 << SpdyFramer::ErrorCodeToString(framer.error_code()); |
| 4960 } | 4960 } |
| 4961 | 4961 |
| 4962 } // namespace net | 4962 } // namespace net |
| OLD | NEW |