h2_runtime.cc

Go to the documentation of this file.

/*
 * Copyright (C) Max Dymond, <cmeister2@gmail.com>, et al.
 *
 * SPDX-License-Identifier: curl
 */

 
#include "proto_fuzzer/h2_runtime.h"
 
#include <curl/multi.h>
 
#include <algorithm>
#include <limits>
#include <utility>
 
#include "proto_fuzzer/mock_server.h"
 
namespace proto_fuzzer {
 
namespace {
 
// Bound header inspection independently of curl's PUSH_PROMISE limits.
constexpr std::size_t kMaxInspectedPushHeaders = 16;
// One extra easy handle exercises accepted push without multiplying work.
constexpr std::size_t kMaxAcceptedPushes = 1;
 
}  // namespace

H2Runtime::H2Runtime() = default;

void H2Runtime::PrepareMulti(CURLM* multi, bool accept_push) {
  accept_push_ = accept_push;
  accepted_push_count_ = 0;
  pushed_body_bytes_ = 0;
  (void)curl_multi_setopt(multi, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX);
  (void)curl_multi_setopt(multi, CURLMOPT_PUSHFUNCTION, &H2Runtime::PushCallback);
  (void)curl_multi_setopt(multi, CURLMOPT_PUSHDATA, this);
}

void H2Runtime::AttachConnection(MockConnection* connection) {
  if (connection != nullptr) {
    connection->SetIncomingDataObserver(&plan_driver_);
  }
}

void H2Runtime::ResetPlan(const curl::fuzzer::proto::Http2Plan& plan, std::string scheme, std::string authority) {
  plan_driver_.Reset(plan, std::move(scheme), std::move(authority));
  stream_weight_after_headers_ = plan.stream_weight_after_headers();
  post_headers_transition_applied_ = false;
  stream_weight_setopt_result_ = CURLE_FAILED_INIT;
  stream_weight_egress_result_ = CURLE_FAILED_INIT;
}

void H2Runtime::ApplyPostHeadersTransition(CURL* easy) {
  if (stream_weight_after_headers_ == 0 || post_headers_transition_applied_ ||
      plan_driver_.observed_request_count() == 0) {
    return;
  }
  post_headers_transition_applied_ = true;
  stream_weight_setopt_result_ =
      curl_easy_setopt(easy, CURLOPT_STREAM_WEIGHT, static_cast<long>(stream_weight_after_headers_));
  // Unpausing an already-running H2 stream is a documented no-op at the
  // transfer layer, but it deliberately asks the live filter to flush its
  // updated flow/priority state. This public call provides a deterministic
  // egress boundary without sleeping or depending on socket readiness.
  stream_weight_egress_result_ = curl_easy_pause(easy, CURLPAUSE_CONT);
}

void H2Runtime::DrivePlan(CURLM* multi, MockServer& server, int max_idle_iterations, int max_drive_iterations,
                          const std::function<void()>& after_perform) {
  int still_running = 1;
  int idle_iterations = 0;
  int drive_iterations = 0;
  while (still_running && idle_iterations < max_idle_iterations && drive_iterations++ < max_drive_iterations) {
    const int running_before = still_running;
    if (curl_multi_perform(multi, &still_running) != CURLM_OK) {
      break;
    }
    after_perform();
    if (!still_running) {
      break;
    }
 
    bool made_progress = still_running != running_before;
    if (MockConnection* connection = server.connection(); connection != nullptr) {
      made_progress = connection->DrainIncoming() != 0 || made_progress;
      std::string chunk;
      if (plan_driver_.NextChunk(&chunk)) {
        made_progress = true;
        if (!chunk.empty()) {
          (void)connection->WriteAll(reinterpret_cast<const unsigned char*>(chunk.data()), chunk.size());
        }
        made_progress = connection->DrainIncoming() != 0 || made_progress;
      }
    }
    if (made_progress) {
      idle_iterations = 0;
    } else {
      ++idle_iterations;
    }
  }
}

void H2Runtime::FinishTransfer(CURL* easy, MockConnection* connection) {
  upkeep_result_ = curl_easy_upkeep(easy);
  if (connection != nullptr) {
    (void)connection->DrainIncoming();
  }
 
#if defined(PROTO_FUZZER_OBSERVE_STATE)
  // The carrier still owns every callback and plan observation here. Retain
  // the completed state in profiling builds without changing the H2 exchange
  // or adding per-input work to ordinary fuzz targets.
  const volatile std::size_t observation[] = {push_callback_count(),
                                              push_header_count(),
                                              saw_push_path(),
                                              accepted_push_count(),
                                              pushed_body_bytes(),
                                              static_cast<std::size_t>(upkeep_result()),
                                              observed_request_count(),
                                              observed_client_settings_count(),
                                              plan_driver_.has_pending_work()};
  (void)observation;
#endif
}

std::size_t H2Runtime::push_callback_count() const { return push_callback_count_; }

std::size_t H2Runtime::push_header_count() const { return push_header_count_; }

bool H2Runtime::saw_push_path() const { return saw_push_path_; }

std::size_t H2Runtime::accepted_push_count() const { return accepted_push_count_; }

std::size_t H2Runtime::pushed_body_bytes() const { return pushed_body_bytes_; }

CURLcode H2Runtime::upkeep_result() const { return upkeep_result_; }

std::size_t H2Runtime::observed_request_count() const { return plan_driver_.observed_request_count(); }

std::size_t H2Runtime::observed_client_settings_count() const { return plan_driver_.observed_client_settings_count(); }

std::size_t H2Runtime::observed_client_priority_count() const { return plan_driver_.observed_client_priority_count(); }

bool H2Runtime::post_headers_transition_applied() const { return post_headers_transition_applied_; }

CURLcode H2Runtime::stream_weight_setopt_result() const { return stream_weight_setopt_result_; }

CURLcode H2Runtime::stream_weight_egress_result() const { return stream_weight_egress_result_; }
 
int H2Runtime::PushCallback(CURL* /*parent*/, CURL* pushed, std::size_t header_count, struct curl_pushheaders* headers,
                            void* userdata) {
  auto* self = static_cast<H2Runtime*>(userdata);
  if (self == nullptr) {
    return CURL_PUSH_DENY;
  }
 
  ++self->push_callback_count_;
  self->push_header_count_ += header_count;
  const std::size_t inspected = std::min(header_count, kMaxInspectedPushHeaders);
  for (std::size_t index = 0; index < inspected; ++index) {
    (void)curl_pushheader_bynum(headers, index);
  }
  self->saw_push_path_ = curl_pushheader_byname(headers, ":path") != nullptr;
  (void)curl_pushheader_byname(headers, "x-fuzzer-missing");
 
  if (!self->accept_push_ || self->accepted_push_count_ >= kMaxAcceptedPushes) {
    return CURL_PUSH_DENY;
  }
  // The new pushed handle needs an application-owned sink before acceptance.
  if (curl_easy_setopt(pushed, CURLOPT_WRITEFUNCTION, &H2Runtime::PushedWriteCallback) != CURLE_OK ||
      curl_easy_setopt(pushed, CURLOPT_WRITEDATA, self) != CURLE_OK) {
    return CURL_PUSH_DENY;
  }
  ++self->accepted_push_count_;
  return CURL_PUSH_OK;
}
 
std::size_t H2Runtime::PushedWriteCallback(char* /*contents*/, std::size_t size, std::size_t nmemb, void* userdata) {
  auto* self = static_cast<H2Runtime*>(userdata);
  const std::size_t maximum = std::numeric_limits<std::size_t>::max();
  if (self == nullptr || (size != 0 && nmemb > maximum / size)) {
    return 0;
  }
  const std::size_t bytes = size * nmemb;
  self->pushed_body_bytes_ += std::min(bytes, maximum - self->pushed_body_bytes_);
  return bytes;
}
 
}  // namespace proto_fuzzer