From eb9118f0c9b9a70c0d2356838190350e9f88ed6f Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sun, 5 Jul 2020 23:01:22 +0100 Subject: [PATCH] Problem: no fuzz testing for websockets Solution: add tests for plain WS --- Makefile.am | 34 +++++++++ tests/test_bind_ws_fuzzer.cpp | 125 +++++++++++++++++++++++++++++++ tests/test_connect_ws_fuzzer.cpp | 125 +++++++++++++++++++++++++++++++ tests/testutil.cpp | 23 ++++-- tests/testutil.hpp | 4 + 5 files changed, 305 insertions(+), 6 deletions(-) create mode 100644 tests/test_bind_ws_fuzzer.cpp create mode 100644 tests/test_connect_ws_fuzzer.cpp diff --git a/Makefile.am b/Makefile.am index b0e0bc85..528df3f6 100755 --- a/Makefile.am +++ b/Makefile.am @@ -1185,6 +1185,27 @@ tests_test_z85_decode_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS} tests_test_z85_decode_fuzzer_CXXFLAGS = -std=c++11 endif +if HAVE_WS +fuzzer_apps += tests/test_connect_ws_fuzzer \ + tests/test_bind_ws_fuzzer + +tests_test_connect_ws_fuzzer_DEPENDENCIES = src/libzmq.la +tests_test_connect_ws_fuzzer_SOURCES = tests/test_connect_ws_fuzzer.cpp +tests_test_connect_ws_fuzzer_LDADD = ${TESTUTIL_LIBS} ${FUZZING_ENGINE_LIB} \ + $(top_builddir)/src/.libs/libzmq.a \ + ${src_libzmq_la_LIBADD} +tests_test_connect_ws_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS} +tests_test_connect_ws_fuzzer_CXXFLAGS = -std=c++11 + +tests_test_bind_ws_fuzzer_DEPENDENCIES = src/libzmq.la +tests_test_bind_ws_fuzzer_SOURCES = tests/test_bind_ws_fuzzer.cpp +tests_test_bind_ws_fuzzer_LDADD = ${TESTUTIL_LIBS} ${FUZZING_ENGINE_LIB} \ + $(top_builddir)/src/.libs/libzmq.a \ + ${src_libzmq_la_LIBADD} +tests_test_bind_ws_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS} +tests_test_bind_ws_fuzzer_CXXFLAGS = -std=c++11 +endif + FUZZINGdir = ${prefix}/${FUZZING_INSTALLDIR} FUZZING_PROGRAMS = ${fuzzer_apps} else @@ -1226,6 +1247,19 @@ tests_test_z85_decode_fuzzer_SOURCES = tests/test_z85_decode_fuzzer.cpp tests_test_z85_decode_fuzzer_LDADD = ${TESTUTIL_LIBS} src/libzmq.la tests_test_z85_decode_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS} endif + +if HAVE_WS +test_apps += tests/test_connect_ws_fuzzer \ + tests/test_bind_ws_fuzzer + +tests_test_connect_ws_fuzzer_SOURCES = tests/test_connect_ws_fuzzer.cpp +tests_test_connect_ws_fuzzer_LDADD = ${TESTUTIL_LIBS} src/libzmq.la +tests_test_connect_ws_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS} + +tests_test_bind_ws_fuzzer_SOURCES = tests/test_bind_ws_fuzzer.cpp +tests_test_bind_ws_fuzzer_LDADD = ${TESTUTIL_LIBS} src/libzmq.la +tests_test_bind_ws_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS} +endif endif if ENABLE_STATIC diff --git a/tests/test_bind_ws_fuzzer.cpp b/tests/test_bind_ws_fuzzer.cpp new file mode 100644 index 00000000..c4f57a9d --- /dev/null +++ b/tests/test_bind_ws_fuzzer.cpp @@ -0,0 +1,125 @@ +/* + Copyright (c) 2020 Contributors as noted in the AUTHORS file + + This file is part of libzmq, the ZeroMQ core engine in C++. + + libzmq is free software; you can redistribute it and/or modify it under + the terms of the GNU Lesser General Public License (LGPL) as published + by the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + As a special exception, the Contributors give you permission to link + this library with independent modules to produce an executable, + regardless of the license terms of these independent modules, and to + copy and distribute the resulting executable under terms of your choice, + provided that you also meet, for each linked independent module, the + terms and conditions of the license of that module. An independent + module is a module which is not derived from or based on this library. + If you modify this library, you must extend this exception to your + version of the library. + + libzmq is distributed in the hope that it will be useful, but WITHOUT + ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public + License for more details. + + You should have received a copy of the GNU Lesser General Public License + along with this program. If not, see . +*/ + +#ifdef ZMQ_USE_FUZZING_ENGINE +#include +#endif + +#include "testutil.hpp" +#include "testutil_unity.hpp" + +// Test that the ZMTP WebSocket engine handles invalid handshake when connecting +// https://rfc.zeromq.org/spec/45/ +extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size) +{ + setup_test_context (); + char my_endpoint[MAX_SOCKET_STRING]; + size_t my_endpoint_size = sizeof (my_endpoint); + void *server = test_context_socket (ZMQ_SERVER); + // As per API by default there's no limit to the size of a message, + // but the sanitizer allocator will barf over a gig or so + int64_t max_msg_size = 64 * 1024 * 1024; + TEST_ASSERT_SUCCESS_ERRNO ( + zmq_setsockopt (server, ZMQ_MAXMSGSIZE, &max_msg_size, sizeof (int64_t))); + TEST_ASSERT_SUCCESS_ERRNO (zmq_bind (server, "ws://127.0.0.1:*")); + TEST_ASSERT_SUCCESS_ERRNO (zmq_getsockopt (server, ZMQ_LAST_ENDPOINT, + my_endpoint, &my_endpoint_size)); + // Remove trailing / + my_endpoint[my_endpoint_size - 2] = '\0'; + fd_t client = connect_socket (my_endpoint, AF_INET, IPPROTO_WS); + + void *client_good = test_context_socket (ZMQ_CLIENT); + my_endpoint[my_endpoint_size - 2] = '/'; + TEST_ASSERT_SUCCESS_ERRNO (zmq_connect (client_good, my_endpoint)); + + // If there is not enough data for a full handshake, just send what we can + // Otherwise send websocket handshake first, as expected by the protocol + uint8_t buf[256]; + if (size >= 192) { + send (client, (void *) data, 192, MSG_NOSIGNAL); + data += 192; + size -= 192; + } + recv (client, buf, 256, MSG_DONTWAIT); + msleep (250); + for (ssize_t sent = 0; size > 0 && (sent != -1 || errno == EINTR); + size -= sent > 0 ? sent : 0, data += sent > 0 ? sent : 0) + sent = send (client, (const char *) data, size, MSG_NOSIGNAL); + msleep (250); + recv (client, buf, 256, MSG_DONTWAIT); + + zmq_msg_t msg; + zmq_msg_init (&msg); + while (-1 != zmq_msg_recv (&msg, server, ZMQ_DONTWAIT)) { + zmq_msg_close (&msg); + zmq_msg_init (&msg); + } + + send_string_expect_success (client_good, "abc", 0); + recv_string_expect_success (server, "abc", 0); + + close (client); + test_context_socket_close_zero_linger (client_good); + test_context_socket_close_zero_linger (server); + teardown_test_context (); + + return 0; +} + +#ifndef ZMQ_USE_FUZZING_ENGINE +void test_bind_ws_fuzzer () +{ + uint8_t **data; + size_t *len, num_cases = 0; + if (fuzzer_corpus_encode ( + "tests/libzmq-fuzz-corpora/test_bind_ws_fuzzer_seed_corpus", &data, + &len, &num_cases) + != 0) + exit (77); + + while (num_cases-- > 0) { + TEST_ASSERT_SUCCESS_ERRNO ( + LLVMFuzzerTestOneInput (data[num_cases], len[num_cases])); + free (data[num_cases]); + } + + free (data); + free (len); +} + +int main (int argc, char **argv) +{ + setup_test_environment (); + + UNITY_BEGIN (); + RUN_TEST (test_bind_ws_fuzzer); + + return UNITY_END (); +} +#endif diff --git a/tests/test_connect_ws_fuzzer.cpp b/tests/test_connect_ws_fuzzer.cpp new file mode 100644 index 00000000..cdd0180b --- /dev/null +++ b/tests/test_connect_ws_fuzzer.cpp @@ -0,0 +1,125 @@ +/* + Copyright (c) 2020 Contributors as noted in the AUTHORS file + + This file is part of libzmq, the ZeroMQ core engine in C++. + + libzmq is free software; you can redistribute it and/or modify it under + the terms of the GNU Lesser General Public License (LGPL) as published + by the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + As a special exception, the Contributors give you permission to link + this library with independent modules to produce an executable, + regardless of the license terms of these independent modules, and to + copy and distribute the resulting executable under terms of your choice, + provided that you also meet, for each linked independent module, the + terms and conditions of the license of that module. An independent + module is a module which is not derived from or based on this library. + If you modify this library, you must extend this exception to your + version of the library. + + libzmq is distributed in the hope that it will be useful, but WITHOUT + ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public + License for more details. + + You should have received a copy of the GNU Lesser General Public License + along with this program. If not, see . +*/ + +#ifdef ZMQ_USE_FUZZING_ENGINE +#include +#endif + +#include "testutil.hpp" +#include "testutil_unity.hpp" + +// Test that the ZMTP WebSocket engine handles invalid handshake when connecting +// https://rfc.zeromq.org/spec/45/ +extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size) +{ + setup_test_context (); + char my_endpoint[MAX_SOCKET_STRING]; + fd_t server = bind_socket_resolve_port ("127.0.0.1", "0", my_endpoint, + AF_INET, IPPROTO_WS); + + void *client = test_context_socket (ZMQ_PULL); + // As per API by default there's no limit to the size of a message, + // but the sanitizer allocator will barf over a gig or so + int64_t max_msg_size = 64 * 1024 * 1024; + TEST_ASSERT_SUCCESS_ERRNO ( + zmq_setsockopt (client, ZMQ_MAXMSGSIZE, &max_msg_size, sizeof (int64_t))); + TEST_ASSERT_SUCCESS_ERRNO (zmq_connect (client, my_endpoint)); + + fd_t server_accept = + TEST_ASSERT_SUCCESS_RAW_ERRNO (accept (server, NULL, NULL)); + + // If there is not enough data for a full handshake, just send what we can + // Otherwise send websocket handshake first, as expected by the protocol + uint8_t buf[256]; + recv (server_accept, buf, 256, 0); + if (size >= 166) { + send (server_accept, (void *) data, 166, MSG_NOSIGNAL); + data += 166; + size -= 166; + } + recv (server_accept, buf, 256, MSG_DONTWAIT); + // Then send the READY command + if (size >= 29) { + send (server_accept, (void *) data, 29, MSG_NOSIGNAL); + data += 29; + size -= 29; + } + msleep (250); + for (ssize_t sent = 0; size > 0 && (sent != -1 || errno == EINTR); + size -= sent > 0 ? sent : 0, data += sent > 0 ? sent : 0) + sent = send (server_accept, (const char *) data, size, MSG_NOSIGNAL); + msleep (250); + + zmq_msg_t msg; + zmq_msg_init (&msg); + while (-1 != zmq_msg_recv (&msg, client, ZMQ_DONTWAIT)) { + zmq_msg_close (&msg); + zmq_msg_init (&msg); + } + + close (server_accept); + close (server); + + test_context_socket_close_zero_linger (client); + teardown_test_context (); + + return 0; +} + +#ifndef ZMQ_USE_FUZZING_ENGINE +void test_connect_ws_fuzzer () +{ + uint8_t **data; + size_t *len, num_cases = 0; + if (fuzzer_corpus_encode ( + "tests/libzmq-fuzz-corpora/test_connect_ws_fuzzer_seed_corpus", &data, + &len, &num_cases) + != 0) + exit (77); + + while (num_cases-- > 0) { + TEST_ASSERT_SUCCESS_ERRNO ( + LLVMFuzzerTestOneInput (data[num_cases], len[num_cases])); + free (data[num_cases]); + } + + free (data); + free (len); +} + +int main (int argc, char **argv) +{ + setup_test_environment (); + + UNITY_BEGIN (); + RUN_TEST (test_connect_ws_fuzzer); + + return UNITY_END (); +} +#endif diff --git a/tests/testutil.cpp b/tests/testutil.cpp index c87caba0..5a8b3ff2 100644 --- a/tests/testutil.cpp +++ b/tests/testutil.cpp @@ -378,7 +378,10 @@ fd_t connect_socket (const char *endpoint_, const int af_, const int protocol_) struct sockaddr_storage addr; // OSX is very opinionated and wants the size to match the AF family type socklen_t addr_len; - const fd_t s_pre = socket (af_, SOCK_STREAM, protocol_); + const fd_t s_pre = socket (af_, SOCK_STREAM, + protocol_ == IPPROTO_UDP + ? IPPROTO_UDP + : protocol_ == IPPROTO_TCP ? IPPROTO_TCP : 0); TEST_ASSERT_NOT_EQUAL (-1, s_pre); if (af_ == AF_INET || af_ == AF_INET6) { @@ -397,8 +400,8 @@ fd_t connect_socket (const char *endpoint_, const int af_, const int protocol_) memset (&hint, 0, sizeof (struct addrinfo)); hint.ai_flags = AI_NUMERICSERV; hint.ai_family = af_; - hint.ai_socktype = SOCK_STREAM; - hint.ai_protocol = protocol_; + hint.ai_socktype = protocol_ == IPPROTO_UDP ? SOCK_DGRAM : SOCK_STREAM; + hint.ai_protocol = protocol_ == IPPROTO_UDP ? IPPROTO_UDP : IPPROTO_TCP; TEST_ASSERT_SUCCESS_RAW_ZERO_ERRNO ( getaddrinfo (address, port, &hint, &in)); @@ -432,7 +435,10 @@ fd_t bind_socket_resolve_port (const char *address_, struct sockaddr_storage addr; // OSX is very opinionated and wants the size to match the AF family type socklen_t addr_len; - const fd_t s_pre = socket (af_, SOCK_STREAM, protocol_); + const fd_t s_pre = socket (af_, SOCK_STREAM, + protocol_ == IPPROTO_UDP + ? IPPROTO_UDP + : protocol_ == IPPROTO_TCP ? IPPROTO_TCP : 0); TEST_ASSERT_NOT_EQUAL (-1, s_pre); if (af_ == AF_INET || af_ == AF_INET6) { @@ -448,7 +454,7 @@ fd_t bind_socket_resolve_port (const char *address_, hint.ai_flags = AI_NUMERICSERV; hint.ai_family = af_; hint.ai_socktype = protocol_ == IPPROTO_UDP ? SOCK_DGRAM : SOCK_STREAM; - hint.ai_protocol = protocol_; + hint.ai_protocol = protocol_ == IPPROTO_UDP ? IPPROTO_UDP : IPPROTO_TCP; TEST_ASSERT_SUCCESS_RAW_ERRNO ( setsockopt (s_pre, SOL_SOCKET, SO_REUSEADDR, &flag, sizeof (int))); @@ -501,7 +507,12 @@ fd_t bind_socket_resolve_port (const char *address_, TEST_ASSERT_SUCCESS_RAW_ERRNO ( getsockname (s_pre, (struct sockaddr *) &addr, &addr_len)); sprintf (my_endpoint_, "%s://%s:%u", - protocol_ == IPPROTO_TCP ? "tcp" : "udp", address_, + protocol_ == IPPROTO_TCP + ? "tcp" + : protocol_ == IPPROTO_UDP + ? "udp" + : protocol_ == IPPROTO_WSS ? "wss" : "ws", + address_, af_ == AF_INET ? ntohs ((*(struct sockaddr_in *) &addr).sin_port) : ntohs ((*(struct sockaddr_in6 *) &addr).sin6_port)); diff --git a/tests/testutil.hpp b/tests/testutil.hpp index c8567391..c6f5e4de 100644 --- a/tests/testutil.hpp +++ b/tests/testutil.hpp @@ -212,6 +212,10 @@ int test_inet_pton (int af_, const char *src_, void *dst_); // Binds an ipv4 BSD socket to an ephemeral port, returns the compiled sockaddr struct sockaddr_in bind_bsd_socket (int socket); +// Some custom definitions in addition to IPPROTO_TCP and IPPROTO_UDP +#define IPPROTO_WS 10000 +#define IPPROTO_WSS 10001 + // Connects a BSD socket to the ZMQ endpoint. Works with ipv4/ipv6/unix. fd_t connect_socket (const char *endpoint_, const int af_ = AF_INET,