fuzz_http.c 3.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134
  1. /* Copyright (c) 2016-2019, The Tor Project, Inc. */
  2. /* See LICENSE for licensing information */
  3. #include "orconfig.h"
  4. #define BUFFERS_PRIVATE
  5. #define DIRCACHE_PRIVATE
  6. #include "core/or/or.h"
  7. #include "lib/err/backtrace.h"
  8. #include "lib/buf/buffers.h"
  9. #include "app/config/config.h"
  10. #include "core/mainloop/connection.h"
  11. #include "feature/dircache/dircache.h"
  12. #include "lib/log/log.h"
  13. #include "feature/dircommon/dir_connection_st.h"
  14. #include "test/fuzz/fuzzing.h"
  15. static void
  16. mock_connection_write_to_buf_impl_(const char *string, size_t len,
  17. connection_t *conn, int compressed)
  18. {
  19. log_debug(LD_GENERAL, "%sResponse:\n%u\nConnection: %p\n%s\n",
  20. compressed ? "Compressed " : "", (unsigned)len, conn, string);
  21. }
  22. static int
  23. mock_directory_handle_command_get(dir_connection_t *conn,
  24. const char *headers,
  25. const char *body,
  26. size_t body_len)
  27. {
  28. (void)conn;
  29. log_debug(LD_GENERAL, "Method:\nGET\n");
  30. if (headers) {
  31. log_debug(LD_GENERAL, "Header-Length:\n%u\n", (unsigned)strlen(headers));
  32. log_debug(LD_GENERAL, "Headers:\n%s\n", headers);
  33. }
  34. log_debug(LD_GENERAL, "Body-Length:\n%u\n", (unsigned)body_len);
  35. if (body) {
  36. log_debug(LD_GENERAL, "Body:\n%s\n", body);
  37. }
  38. /* Always tell the caller we succeeded */
  39. return 0;
  40. }
  41. static int
  42. mock_directory_handle_command_post(dir_connection_t *conn,
  43. const char *headers,
  44. const char *body,
  45. size_t body_len)
  46. {
  47. (void)conn;
  48. log_debug(LD_GENERAL, "Method:\nPOST\n");
  49. if (headers) {
  50. log_debug(LD_GENERAL, "Header-Length:\n%u\n", (unsigned)strlen(headers));
  51. log_debug(LD_GENERAL, "Headers:\n%s\n", headers);
  52. }
  53. log_debug(LD_GENERAL, "Body-Length:\n%u\n", (unsigned)body_len);
  54. if (body) {
  55. log_debug(LD_GENERAL, "Body:\n%s\n", body);
  56. }
  57. /* Always tell the caller we succeeded */
  58. return 0;
  59. }
  60. int
  61. fuzz_init(void)
  62. {
  63. /* Set up fake response handler */
  64. MOCK(connection_write_to_buf_impl_, mock_connection_write_to_buf_impl_);
  65. /* Set up the fake handler functions */
  66. MOCK(directory_handle_command_get, mock_directory_handle_command_get);
  67. MOCK(directory_handle_command_post, mock_directory_handle_command_post);
  68. return 0;
  69. }
  70. int
  71. fuzz_cleanup(void)
  72. {
  73. UNMOCK(connection_write_to_buf_impl_);
  74. UNMOCK(directory_handle_command_get);
  75. UNMOCK(directory_handle_command_post);
  76. return 0;
  77. }
  78. int
  79. fuzz_main(const uint8_t *stdin_buf, size_t data_size)
  80. {
  81. dir_connection_t dir_conn;
  82. /* Set up the fake connection */
  83. memset(&dir_conn, 0, sizeof(dir_connection_t));
  84. dir_conn.base_.type = CONN_TYPE_DIR;
  85. /* Apparently tor sets this before directory_handle_command() is called. */
  86. dir_conn.base_.address = tor_strdup("replace-this-address.example.com");
  87. dir_conn.base_.inbuf = buf_new_with_data((char*)stdin_buf, data_size);
  88. if (!dir_conn.base_.inbuf) {
  89. log_debug(LD_GENERAL, "Zero-Length-Input\n");
  90. goto done;
  91. }
  92. /* Parse the headers */
  93. int rv = directory_handle_command(&dir_conn);
  94. /* TODO: check the output is correctly parsed based on the input */
  95. /* Report the parsed origin address */
  96. if (dir_conn.base_.address) {
  97. log_debug(LD_GENERAL, "Address:\n%s\n", dir_conn.base_.address);
  98. }
  99. log_debug(LD_GENERAL, "Result:\n%d\n", rv);
  100. done:
  101. /* Reset. */
  102. tor_free(dir_conn.base_.address);
  103. buf_free(dir_conn.base_.inbuf);
  104. dir_conn.base_.inbuf = NULL;
  105. return 0;
  106. }