mirror of
https://github.com/zeromq/libzmq.git
synced 2024-12-12 10:33:52 +01:00
Problem: no fuzz testing for websockets
Solution: add tests for plain WS
This commit is contained in:
parent
2352e0a896
commit
eb9118f0c9
34
Makefile.am
34
Makefile.am
@ -1185,6 +1185,27 @@ tests_test_z85_decode_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
|
||||
tests_test_z85_decode_fuzzer_CXXFLAGS = -std=c++11
|
||||
endif
|
||||
|
||||
if HAVE_WS
|
||||
fuzzer_apps += tests/test_connect_ws_fuzzer \
|
||||
tests/test_bind_ws_fuzzer
|
||||
|
||||
tests_test_connect_ws_fuzzer_DEPENDENCIES = src/libzmq.la
|
||||
tests_test_connect_ws_fuzzer_SOURCES = tests/test_connect_ws_fuzzer.cpp
|
||||
tests_test_connect_ws_fuzzer_LDADD = ${TESTUTIL_LIBS} ${FUZZING_ENGINE_LIB} \
|
||||
$(top_builddir)/src/.libs/libzmq.a \
|
||||
${src_libzmq_la_LIBADD}
|
||||
tests_test_connect_ws_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
|
||||
tests_test_connect_ws_fuzzer_CXXFLAGS = -std=c++11
|
||||
|
||||
tests_test_bind_ws_fuzzer_DEPENDENCIES = src/libzmq.la
|
||||
tests_test_bind_ws_fuzzer_SOURCES = tests/test_bind_ws_fuzzer.cpp
|
||||
tests_test_bind_ws_fuzzer_LDADD = ${TESTUTIL_LIBS} ${FUZZING_ENGINE_LIB} \
|
||||
$(top_builddir)/src/.libs/libzmq.a \
|
||||
${src_libzmq_la_LIBADD}
|
||||
tests_test_bind_ws_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
|
||||
tests_test_bind_ws_fuzzer_CXXFLAGS = -std=c++11
|
||||
endif
|
||||
|
||||
FUZZINGdir = ${prefix}/${FUZZING_INSTALLDIR}
|
||||
FUZZING_PROGRAMS = ${fuzzer_apps}
|
||||
else
|
||||
@ -1226,6 +1247,19 @@ tests_test_z85_decode_fuzzer_SOURCES = tests/test_z85_decode_fuzzer.cpp
|
||||
tests_test_z85_decode_fuzzer_LDADD = ${TESTUTIL_LIBS} src/libzmq.la
|
||||
tests_test_z85_decode_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
|
||||
endif
|
||||
|
||||
if HAVE_WS
|
||||
test_apps += tests/test_connect_ws_fuzzer \
|
||||
tests/test_bind_ws_fuzzer
|
||||
|
||||
tests_test_connect_ws_fuzzer_SOURCES = tests/test_connect_ws_fuzzer.cpp
|
||||
tests_test_connect_ws_fuzzer_LDADD = ${TESTUTIL_LIBS} src/libzmq.la
|
||||
tests_test_connect_ws_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
|
||||
|
||||
tests_test_bind_ws_fuzzer_SOURCES = tests/test_bind_ws_fuzzer.cpp
|
||||
tests_test_bind_ws_fuzzer_LDADD = ${TESTUTIL_LIBS} src/libzmq.la
|
||||
tests_test_bind_ws_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
|
||||
endif
|
||||
endif
|
||||
|
||||
if ENABLE_STATIC
|
||||
|
125
tests/test_bind_ws_fuzzer.cpp
Normal file
125
tests/test_bind_ws_fuzzer.cpp
Normal file
@ -0,0 +1,125 @@
|
||||
/*
|
||||
Copyright (c) 2020 Contributors as noted in the AUTHORS file
|
||||
|
||||
This file is part of libzmq, the ZeroMQ core engine in C++.
|
||||
|
||||
libzmq is free software; you can redistribute it and/or modify it under
|
||||
the terms of the GNU Lesser General Public License (LGPL) as published
|
||||
by the Free Software Foundation; either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
As a special exception, the Contributors give you permission to link
|
||||
this library with independent modules to produce an executable,
|
||||
regardless of the license terms of these independent modules, and to
|
||||
copy and distribute the resulting executable under terms of your choice,
|
||||
provided that you also meet, for each linked independent module, the
|
||||
terms and conditions of the license of that module. An independent
|
||||
module is a module which is not derived from or based on this library.
|
||||
If you modify this library, you must extend this exception to your
|
||||
version of the library.
|
||||
|
||||
libzmq is distributed in the hope that it will be useful, but WITHOUT
|
||||
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public
|
||||
License for more details.
|
||||
|
||||
You should have received a copy of the GNU Lesser General Public License
|
||||
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
#ifdef ZMQ_USE_FUZZING_ENGINE
|
||||
#include <fuzzer/FuzzedDataProvider.h>
|
||||
#endif
|
||||
|
||||
#include "testutil.hpp"
|
||||
#include "testutil_unity.hpp"
|
||||
|
||||
// Test that the ZMTP WebSocket engine handles invalid handshake when connecting
|
||||
// https://rfc.zeromq.org/spec/45/
|
||||
extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
|
||||
{
|
||||
setup_test_context ();
|
||||
char my_endpoint[MAX_SOCKET_STRING];
|
||||
size_t my_endpoint_size = sizeof (my_endpoint);
|
||||
void *server = test_context_socket (ZMQ_SERVER);
|
||||
// As per API by default there's no limit to the size of a message,
|
||||
// but the sanitizer allocator will barf over a gig or so
|
||||
int64_t max_msg_size = 64 * 1024 * 1024;
|
||||
TEST_ASSERT_SUCCESS_ERRNO (
|
||||
zmq_setsockopt (server, ZMQ_MAXMSGSIZE, &max_msg_size, sizeof (int64_t)));
|
||||
TEST_ASSERT_SUCCESS_ERRNO (zmq_bind (server, "ws://127.0.0.1:*"));
|
||||
TEST_ASSERT_SUCCESS_ERRNO (zmq_getsockopt (server, ZMQ_LAST_ENDPOINT,
|
||||
my_endpoint, &my_endpoint_size));
|
||||
// Remove trailing /
|
||||
my_endpoint[my_endpoint_size - 2] = '\0';
|
||||
fd_t client = connect_socket (my_endpoint, AF_INET, IPPROTO_WS);
|
||||
|
||||
void *client_good = test_context_socket (ZMQ_CLIENT);
|
||||
my_endpoint[my_endpoint_size - 2] = '/';
|
||||
TEST_ASSERT_SUCCESS_ERRNO (zmq_connect (client_good, my_endpoint));
|
||||
|
||||
// If there is not enough data for a full handshake, just send what we can
|
||||
// Otherwise send websocket handshake first, as expected by the protocol
|
||||
uint8_t buf[256];
|
||||
if (size >= 192) {
|
||||
send (client, (void *) data, 192, MSG_NOSIGNAL);
|
||||
data += 192;
|
||||
size -= 192;
|
||||
}
|
||||
recv (client, buf, 256, MSG_DONTWAIT);
|
||||
msleep (250);
|
||||
for (ssize_t sent = 0; size > 0 && (sent != -1 || errno == EINTR);
|
||||
size -= sent > 0 ? sent : 0, data += sent > 0 ? sent : 0)
|
||||
sent = send (client, (const char *) data, size, MSG_NOSIGNAL);
|
||||
msleep (250);
|
||||
recv (client, buf, 256, MSG_DONTWAIT);
|
||||
|
||||
zmq_msg_t msg;
|
||||
zmq_msg_init (&msg);
|
||||
while (-1 != zmq_msg_recv (&msg, server, ZMQ_DONTWAIT)) {
|
||||
zmq_msg_close (&msg);
|
||||
zmq_msg_init (&msg);
|
||||
}
|
||||
|
||||
send_string_expect_success (client_good, "abc", 0);
|
||||
recv_string_expect_success (server, "abc", 0);
|
||||
|
||||
close (client);
|
||||
test_context_socket_close_zero_linger (client_good);
|
||||
test_context_socket_close_zero_linger (server);
|
||||
teardown_test_context ();
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
#ifndef ZMQ_USE_FUZZING_ENGINE
|
||||
void test_bind_ws_fuzzer ()
|
||||
{
|
||||
uint8_t **data;
|
||||
size_t *len, num_cases = 0;
|
||||
if (fuzzer_corpus_encode (
|
||||
"tests/libzmq-fuzz-corpora/test_bind_ws_fuzzer_seed_corpus", &data,
|
||||
&len, &num_cases)
|
||||
!= 0)
|
||||
exit (77);
|
||||
|
||||
while (num_cases-- > 0) {
|
||||
TEST_ASSERT_SUCCESS_ERRNO (
|
||||
LLVMFuzzerTestOneInput (data[num_cases], len[num_cases]));
|
||||
free (data[num_cases]);
|
||||
}
|
||||
|
||||
free (data);
|
||||
free (len);
|
||||
}
|
||||
|
||||
int main (int argc, char **argv)
|
||||
{
|
||||
setup_test_environment ();
|
||||
|
||||
UNITY_BEGIN ();
|
||||
RUN_TEST (test_bind_ws_fuzzer);
|
||||
|
||||
return UNITY_END ();
|
||||
}
|
||||
#endif
|
125
tests/test_connect_ws_fuzzer.cpp
Normal file
125
tests/test_connect_ws_fuzzer.cpp
Normal file
@ -0,0 +1,125 @@
|
||||
/*
|
||||
Copyright (c) 2020 Contributors as noted in the AUTHORS file
|
||||
|
||||
This file is part of libzmq, the ZeroMQ core engine in C++.
|
||||
|
||||
libzmq is free software; you can redistribute it and/or modify it under
|
||||
the terms of the GNU Lesser General Public License (LGPL) as published
|
||||
by the Free Software Foundation; either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
As a special exception, the Contributors give you permission to link
|
||||
this library with independent modules to produce an executable,
|
||||
regardless of the license terms of these independent modules, and to
|
||||
copy and distribute the resulting executable under terms of your choice,
|
||||
provided that you also meet, for each linked independent module, the
|
||||
terms and conditions of the license of that module. An independent
|
||||
module is a module which is not derived from or based on this library.
|
||||
If you modify this library, you must extend this exception to your
|
||||
version of the library.
|
||||
|
||||
libzmq is distributed in the hope that it will be useful, but WITHOUT
|
||||
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public
|
||||
License for more details.
|
||||
|
||||
You should have received a copy of the GNU Lesser General Public License
|
||||
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
#ifdef ZMQ_USE_FUZZING_ENGINE
|
||||
#include <fuzzer/FuzzedDataProvider.h>
|
||||
#endif
|
||||
|
||||
#include "testutil.hpp"
|
||||
#include "testutil_unity.hpp"
|
||||
|
||||
// Test that the ZMTP WebSocket engine handles invalid handshake when connecting
|
||||
// https://rfc.zeromq.org/spec/45/
|
||||
extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
|
||||
{
|
||||
setup_test_context ();
|
||||
char my_endpoint[MAX_SOCKET_STRING];
|
||||
fd_t server = bind_socket_resolve_port ("127.0.0.1", "0", my_endpoint,
|
||||
AF_INET, IPPROTO_WS);
|
||||
|
||||
void *client = test_context_socket (ZMQ_PULL);
|
||||
// As per API by default there's no limit to the size of a message,
|
||||
// but the sanitizer allocator will barf over a gig or so
|
||||
int64_t max_msg_size = 64 * 1024 * 1024;
|
||||
TEST_ASSERT_SUCCESS_ERRNO (
|
||||
zmq_setsockopt (client, ZMQ_MAXMSGSIZE, &max_msg_size, sizeof (int64_t)));
|
||||
TEST_ASSERT_SUCCESS_ERRNO (zmq_connect (client, my_endpoint));
|
||||
|
||||
fd_t server_accept =
|
||||
TEST_ASSERT_SUCCESS_RAW_ERRNO (accept (server, NULL, NULL));
|
||||
|
||||
// If there is not enough data for a full handshake, just send what we can
|
||||
// Otherwise send websocket handshake first, as expected by the protocol
|
||||
uint8_t buf[256];
|
||||
recv (server_accept, buf, 256, 0);
|
||||
if (size >= 166) {
|
||||
send (server_accept, (void *) data, 166, MSG_NOSIGNAL);
|
||||
data += 166;
|
||||
size -= 166;
|
||||
}
|
||||
recv (server_accept, buf, 256, MSG_DONTWAIT);
|
||||
// Then send the READY command
|
||||
if (size >= 29) {
|
||||
send (server_accept, (void *) data, 29, MSG_NOSIGNAL);
|
||||
data += 29;
|
||||
size -= 29;
|
||||
}
|
||||
msleep (250);
|
||||
for (ssize_t sent = 0; size > 0 && (sent != -1 || errno == EINTR);
|
||||
size -= sent > 0 ? sent : 0, data += sent > 0 ? sent : 0)
|
||||
sent = send (server_accept, (const char *) data, size, MSG_NOSIGNAL);
|
||||
msleep (250);
|
||||
|
||||
zmq_msg_t msg;
|
||||
zmq_msg_init (&msg);
|
||||
while (-1 != zmq_msg_recv (&msg, client, ZMQ_DONTWAIT)) {
|
||||
zmq_msg_close (&msg);
|
||||
zmq_msg_init (&msg);
|
||||
}
|
||||
|
||||
close (server_accept);
|
||||
close (server);
|
||||
|
||||
test_context_socket_close_zero_linger (client);
|
||||
teardown_test_context ();
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
#ifndef ZMQ_USE_FUZZING_ENGINE
|
||||
void test_connect_ws_fuzzer ()
|
||||
{
|
||||
uint8_t **data;
|
||||
size_t *len, num_cases = 0;
|
||||
if (fuzzer_corpus_encode (
|
||||
"tests/libzmq-fuzz-corpora/test_connect_ws_fuzzer_seed_corpus", &data,
|
||||
&len, &num_cases)
|
||||
!= 0)
|
||||
exit (77);
|
||||
|
||||
while (num_cases-- > 0) {
|
||||
TEST_ASSERT_SUCCESS_ERRNO (
|
||||
LLVMFuzzerTestOneInput (data[num_cases], len[num_cases]));
|
||||
free (data[num_cases]);
|
||||
}
|
||||
|
||||
free (data);
|
||||
free (len);
|
||||
}
|
||||
|
||||
int main (int argc, char **argv)
|
||||
{
|
||||
setup_test_environment ();
|
||||
|
||||
UNITY_BEGIN ();
|
||||
RUN_TEST (test_connect_ws_fuzzer);
|
||||
|
||||
return UNITY_END ();
|
||||
}
|
||||
#endif
|
@ -378,7 +378,10 @@ fd_t connect_socket (const char *endpoint_, const int af_, const int protocol_)
|
||||
struct sockaddr_storage addr;
|
||||
// OSX is very opinionated and wants the size to match the AF family type
|
||||
socklen_t addr_len;
|
||||
const fd_t s_pre = socket (af_, SOCK_STREAM, protocol_);
|
||||
const fd_t s_pre = socket (af_, SOCK_STREAM,
|
||||
protocol_ == IPPROTO_UDP
|
||||
? IPPROTO_UDP
|
||||
: protocol_ == IPPROTO_TCP ? IPPROTO_TCP : 0);
|
||||
TEST_ASSERT_NOT_EQUAL (-1, s_pre);
|
||||
|
||||
if (af_ == AF_INET || af_ == AF_INET6) {
|
||||
@ -397,8 +400,8 @@ fd_t connect_socket (const char *endpoint_, const int af_, const int protocol_)
|
||||
memset (&hint, 0, sizeof (struct addrinfo));
|
||||
hint.ai_flags = AI_NUMERICSERV;
|
||||
hint.ai_family = af_;
|
||||
hint.ai_socktype = SOCK_STREAM;
|
||||
hint.ai_protocol = protocol_;
|
||||
hint.ai_socktype = protocol_ == IPPROTO_UDP ? SOCK_DGRAM : SOCK_STREAM;
|
||||
hint.ai_protocol = protocol_ == IPPROTO_UDP ? IPPROTO_UDP : IPPROTO_TCP;
|
||||
|
||||
TEST_ASSERT_SUCCESS_RAW_ZERO_ERRNO (
|
||||
getaddrinfo (address, port, &hint, &in));
|
||||
@ -432,7 +435,10 @@ fd_t bind_socket_resolve_port (const char *address_,
|
||||
struct sockaddr_storage addr;
|
||||
// OSX is very opinionated and wants the size to match the AF family type
|
||||
socklen_t addr_len;
|
||||
const fd_t s_pre = socket (af_, SOCK_STREAM, protocol_);
|
||||
const fd_t s_pre = socket (af_, SOCK_STREAM,
|
||||
protocol_ == IPPROTO_UDP
|
||||
? IPPROTO_UDP
|
||||
: protocol_ == IPPROTO_TCP ? IPPROTO_TCP : 0);
|
||||
TEST_ASSERT_NOT_EQUAL (-1, s_pre);
|
||||
|
||||
if (af_ == AF_INET || af_ == AF_INET6) {
|
||||
@ -448,7 +454,7 @@ fd_t bind_socket_resolve_port (const char *address_,
|
||||
hint.ai_flags = AI_NUMERICSERV;
|
||||
hint.ai_family = af_;
|
||||
hint.ai_socktype = protocol_ == IPPROTO_UDP ? SOCK_DGRAM : SOCK_STREAM;
|
||||
hint.ai_protocol = protocol_;
|
||||
hint.ai_protocol = protocol_ == IPPROTO_UDP ? IPPROTO_UDP : IPPROTO_TCP;
|
||||
|
||||
TEST_ASSERT_SUCCESS_RAW_ERRNO (
|
||||
setsockopt (s_pre, SOL_SOCKET, SO_REUSEADDR, &flag, sizeof (int)));
|
||||
@ -501,7 +507,12 @@ fd_t bind_socket_resolve_port (const char *address_,
|
||||
TEST_ASSERT_SUCCESS_RAW_ERRNO (
|
||||
getsockname (s_pre, (struct sockaddr *) &addr, &addr_len));
|
||||
sprintf (my_endpoint_, "%s://%s:%u",
|
||||
protocol_ == IPPROTO_TCP ? "tcp" : "udp", address_,
|
||||
protocol_ == IPPROTO_TCP
|
||||
? "tcp"
|
||||
: protocol_ == IPPROTO_UDP
|
||||
? "udp"
|
||||
: protocol_ == IPPROTO_WSS ? "wss" : "ws",
|
||||
address_,
|
||||
af_ == AF_INET
|
||||
? ntohs ((*(struct sockaddr_in *) &addr).sin_port)
|
||||
: ntohs ((*(struct sockaddr_in6 *) &addr).sin6_port));
|
||||
|
@ -212,6 +212,10 @@ int test_inet_pton (int af_, const char *src_, void *dst_);
|
||||
// Binds an ipv4 BSD socket to an ephemeral port, returns the compiled sockaddr
|
||||
struct sockaddr_in bind_bsd_socket (int socket);
|
||||
|
||||
// Some custom definitions in addition to IPPROTO_TCP and IPPROTO_UDP
|
||||
#define IPPROTO_WS 10000
|
||||
#define IPPROTO_WSS 10001
|
||||
|
||||
// Connects a BSD socket to the ZMQ endpoint. Works with ipv4/ipv6/unix.
|
||||
fd_t connect_socket (const char *endpoint_,
|
||||
const int af_ = AF_INET,
|
||||
|
Loading…
Reference in New Issue
Block a user