add a basic fuzzer for the handshake

2020-08-31 14:17:19 +07:00
parent 7c204d4d9e
commit 7f4b8a5914
2 changed files with 390 additions and 0 deletions
--- a/fuzzing/handshake/cmd/corpus.go
+++ b/fuzzing/handshake/cmd/corpus.go
@@ -0,0 +1,151 @@
+package main
+
+import (
+	"crypto/tls"
+	"log"
+
+	fuzzhandshake "github.com/lucas-clemente/quic-go/fuzzing/handshake"
+	"github.com/lucas-clemente/quic-go/fuzzing/internal/helper"
+	"github.com/lucas-clemente/quic-go/internal/handshake"
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/testdata"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+	"github.com/lucas-clemente/quic-go/internal/wire"
+)
+
+type chunk struct {
+	data     []byte
+	encLevel protocol.EncryptionLevel
+}
+
+type stream struct {
+	chunkChan chan<- chunk
+	encLevel  protocol.EncryptionLevel
+}
+
+func (s *stream) Write(b []byte) (int, error) {
+	data := append([]byte{}, b...)
+	select {
+	case s.chunkChan <- chunk{data: data, encLevel: s.encLevel}:
+	default:
+		panic("chunkChan too small")
+	}
+	return len(b), nil
+}
+
+func initStreams() (chan chunk, *stream /* initial */, *stream /* handshake */) {
+	chunkChan := make(chan chunk, 10)
+	initialStream := &stream{chunkChan: chunkChan, encLevel: protocol.EncryptionInitial}
+	handshakeStream := &stream{chunkChan: chunkChan, encLevel: protocol.EncryptionHandshake}
+	return chunkChan, initialStream, handshakeStream
+}
+
+type handshakeRunner interface {
+	OnReceivedParams(*wire.TransportParameters)
+	OnHandshakeComplete()
+	OnError(error)
+	DropKeys(protocol.EncryptionLevel)
+}
+
+type runner struct {
+	client, server *handshake.CryptoSetup
+}
+
+var _ handshakeRunner = &runner{}
+
+func newRunner(client, server *handshake.CryptoSetup) *runner {
+	return &runner{client: client, server: server}
+}
+
+func (r *runner) OnReceivedParams(*wire.TransportParameters) {}
+func (r *runner) OnHandshakeComplete()                       {}
+func (r *runner) OnError(err error) {
+	log.Fatal("runner error:", err)
+	(*r.client).Close()
+	(*r.server).Close()
+}
+func (r *runner) DropKeys(protocol.EncryptionLevel) {}
+
+const alpn = "fuzz"
+
+func main() {
+	cChunkChan, cInitialStream, cHandshakeStream := initStreams()
+	var client, server handshake.CryptoSetup
+	runner := newRunner(&client, &server)
+	client, _ = handshake.NewCryptoSetupClient(
+		cInitialStream,
+		cHandshakeStream,
+		protocol.ConnectionID{},
+		nil,
+		nil,
+		&wire.TransportParameters{},
+		runner,
+		&tls.Config{
+			ServerName: "localhost",
+			NextProtos: []string{alpn},
+			RootCAs:    testdata.GetRootCA(),
+		},
+		false,
+		utils.NewRTTStats(),
+		nil,
+		utils.DefaultLogger.WithPrefix("client"),
+	)
+
+	sChunkChan, sInitialStream, sHandshakeStream := initStreams()
+	config := testdata.GetTLSConfig()
+	config.NextProtos = []string{alpn}
+	server = handshake.NewCryptoSetupServer(
+		sInitialStream,
+		sHandshakeStream,
+		protocol.ConnectionID{},
+		nil,
+		nil,
+		&wire.TransportParameters{},
+		runner,
+		config,
+		false,
+		utils.NewRTTStats(),
+		nil,
+		utils.DefaultLogger.WithPrefix("server"),
+	)
+
+	serverHandshakeCompleted := make(chan struct{})
+	go func() {
+		defer close(serverHandshakeCompleted)
+		server.RunHandshake()
+	}()
+
+	clientHandshakeCompleted := make(chan struct{})
+	go func() {
+		defer close(clientHandshakeCompleted)
+		client.RunHandshake()
+	}()
+
+	done := make(chan struct{})
+	go func() {
+		<-serverHandshakeCompleted
+		<-clientHandshakeCompleted
+		close(done)
+	}()
+
+	var messages [][]byte
+messageLoop:
+	for {
+		select {
+		case c := <-cChunkChan:
+			messages = append(messages, c.data)
+			server.HandleMessage(c.data, c.encLevel)
+		case c := <-sChunkChan:
+			messages = append(messages, c.data)
+			client.HandleMessage(c.data, c.encLevel)
+		case <-done:
+			break messageLoop
+		}
+	}
+
+	for _, m := range messages {
+		if err := helper.WriteCorpusFileWithPrefix("corpus", m, fuzzhandshake.PrefixLen); err != nil {
+			log.Fatal(err)
+		}
+	}
+}