ldap_mock_server.cc

Go to the documentation of this file.

/*
 * Copyright (C) Max Dymond, <cmeister2@gmail.com>, et al.
 *
 * SPDX-License-Identifier: curl
 */

 
#include "proto_fuzzer/ldap_mock_server.h"
 
#include <algorithm>
#include <cstddef>
#include <cstdint>
#include <limits>
#include <memory>
#include <string>
#include <string_view>
 
#include "proto_fuzzer/mock_server.h"
#include "proto_fuzzer/scenario_limits.h"
 
namespace proto_fuzzer {
 
namespace {
 
// RFC 4511 protocol operation tags used by this peer.
constexpr unsigned char kSequenceTag = 0x30;
constexpr unsigned char kBooleanTag = 0x01;
constexpr unsigned char kIntegerTag = 0x02;
constexpr unsigned char kEnumeratedTag = 0x0a;
constexpr unsigned char kOctetStringTag = 0x04;
constexpr unsigned char kUnbindRequest = 0x42;
constexpr unsigned char kBindRequest = 0x60;
constexpr unsigned char kBindResponse = 0x61;
constexpr unsigned char kSearchRequest = 0x63;
constexpr unsigned char kSearchResultEntry = 0x64;
constexpr unsigned char kSearchResultDone = 0x65;
constexpr unsigned char kAbandonRequest = 0x50;
constexpr unsigned char kExtendedRequest = 0x77;
constexpr unsigned char kExtendedResponse = 0x78;
constexpr unsigned char kSetTag = 0x31;
constexpr unsigned char kPresentFilter = 0x87;
constexpr int kLdapSuccess = 0;
constexpr std::string_view kObjectClass = "objectclass";
constexpr std::string_view kSupportedSaslMechanisms = "supportedSASLMechanisms";
constexpr std::string_view kPlainMechanism = "PLAIN";
 
unsigned char ByteAt(std::string_view bytes, std::size_t index) { return static_cast<unsigned char>(bytes[index]); }
 
}  // namespace

LdapMockServer::LdapMockServer()
    : scenario_(nullptr),
      server_chunk_count_(0),
      next_server_chunk_(0),
      bind_request_count_(0),
      search_request_count_(0),
      mechanism_search_request_count_(0),
      starttls_request_count_(0),
      unbind_request_count_(0),
      server_message_count_(0),
      scripted_message_count_(0),
      synthesized_done_count_(0),
      scripted_bind_response_count_(0),
      search_message_id_(0),
      search_active_(false),
      search_done_sent_(false),
      scripted_bind_consumed_(false),
      release_script_chunks_(false),
      peer_closed_(false),
      protocol_error_(false),
      socket_opened_(false) {}

LdapMockServer::~LdapMockServer() = default;

const std::string& LdapMockServer::packet_transcript() const { return packet_transcript_; }

void LdapMockServer::ObserveIncomingData(const unsigned char* data, std::size_t size) {
  if (data == nullptr || size == 0) {
    return;
  }
  pending_client_bytes_.append(reinterpret_cast<const char*>(data), size);
}

std::size_t LdapMockServer::bind_request_count() const { return bind_request_count_; }

std::size_t LdapMockServer::search_request_count() const { return search_request_count_; }

std::size_t LdapMockServer::mechanism_search_request_count() const { return mechanism_search_request_count_; }

std::size_t LdapMockServer::starttls_request_count() const { return starttls_request_count_; }

std::size_t LdapMockServer::unbind_request_count() const { return unbind_request_count_; }

std::size_t LdapMockServer::server_message_count() const { return server_message_count_; }

std::size_t LdapMockServer::scripted_message_count() const { return scripted_message_count_; }

std::size_t LdapMockServer::synthesized_done_count() const { return synthesized_done_count_; }

std::size_t LdapMockServer::scripted_bind_response_count() const { return scripted_bind_response_count_; }

LdapMockServer::ParseResult LdapMockServer::ParseTlv(std::string_view bytes, std::size_t offset, TlvView* view) {
  if (view == nullptr) {
    return ParseResult::kInvalid;
  }
  if (offset >= bytes.size()) {
    return ParseResult::kNeedMore;
  }
 
  const unsigned char tag = ByteAt(bytes, offset);
  if (tag == 0) {
    // End-of-contents is only valid for indefinite lengths, which LDAP forbids
    // in the commands this peer accepts.
    return ParseResult::kInvalid;
  }
 
  std::size_t cursor = offset + 1;
  if (cursor >= bytes.size()) {
    return ParseResult::kNeedMore;
  }
 
  const unsigned char length_byte = ByteAt(bytes, cursor++);
  std::size_t length = 0;
  if ((length_byte & 0x80U) == 0) {
    length = static_cast<std::size_t>(length_byte);
  } else {
    const std::size_t length_bytes = static_cast<std::size_t>(length_byte & 0x7fU);
    if (length_bytes == 0 || length_bytes > 4) {
      return ParseResult::kInvalid;
    }
    if (bytes.size() - cursor < length_bytes) {
      return ParseResult::kNeedMore;
    }
    for (std::size_t index = 0; index < length_bytes; ++index) {
      length = (length << 8U) | static_cast<std::size_t>(ByteAt(bytes, cursor + index));
    }
    cursor += length_bytes;
  }
 
  if (length > kMaxClientMessageBytes) {
    return ParseResult::kInvalid;
  }
  if (bytes.size() - cursor < length) {
    return ParseResult::kNeedMore;
  }
 
  view->tag = tag;
  view->value_offset = cursor;
  view->value_length = length;
  view->total_length = cursor - offset + length;
  return ParseResult::kComplete;
}

bool LdapMockServer::IsSaslMechanismSearch(std::string_view value) {
  std::size_t cursor = 0;
  TlvView field;
  const auto parse_field = [&value, &cursor](unsigned char tag, TlvView* parsed) {
    if (ParseTlv(value, cursor, parsed) != ParseResult::kComplete || parsed->tag != tag) {
      return false;
    }
    cursor = parsed->value_offset + parsed->value_length;
    return true;
  };
  const auto is_zero = [&value](const TlvView& parsed) {
    return parsed.value_length == 1 && ByteAt(value, parsed.value_offset) == 0;
  };
 
  if (!parse_field(kOctetStringTag, &field) || field.value_length != 0 || !parse_field(kEnumeratedTag, &field) ||
      !is_zero(field) || !parse_field(kEnumeratedTag, &field) || !is_zero(field) || !parse_field(kIntegerTag, &field) ||
      !is_zero(field) || !parse_field(kIntegerTag, &field) || !is_zero(field) || !parse_field(kBooleanTag, &field) ||
      !is_zero(field) || !parse_field(kPresentFilter, &field) ||
      value.substr(field.value_offset, field.value_length) != kObjectClass || !parse_field(kSequenceTag, &field) ||
      cursor != value.size()) {
    return false;
  }
 
  const std::size_t attributes_end = field.value_offset + field.value_length;
  TlvView attribute;
  if (ParseTlv(value, field.value_offset, &attribute) != ParseResult::kComplete || attribute.tag != kOctetStringTag ||
      attribute.value_offset + attribute.value_length != attributes_end) {
    return false;
  }
  return value.substr(attribute.value_offset, attribute.value_length) == kSupportedSaslMechanisms;
}

LdapMockServer::ParseResult LdapMockServer::ParseMessage(std::string_view bytes, MessageView* message) {
  if (message == nullptr) {
    return ParseResult::kInvalid;
  }
 
  TlvView outer;
  ParseResult parsed = ParseTlv(bytes, 0, &outer);
  if (parsed != ParseResult::kComplete) {
    return parsed;
  }
  if (outer.tag != kSequenceTag || outer.value_length < 2) {
    return ParseResult::kInvalid;
  }
 
  const std::size_t outer_end = outer.value_offset + outer.value_length;
  TlvView integer;
  parsed = ParseTlv(bytes, outer.value_offset, &integer);
  if (parsed != ParseResult::kComplete) {
    return parsed;
  }
  if (integer.tag != kIntegerTag || integer.value_length == 0 || integer.value_length > 4 ||
      integer.value_offset + integer.value_length > outer_end) {
    return ParseResult::kInvalid;
  }
 
  std::uint32_t message_id = 0;
  for (std::size_t index = 0; index < integer.value_length; ++index) {
    message_id = (message_id << 8U) | static_cast<std::uint32_t>(ByteAt(bytes, integer.value_offset + index));
  }
 
  const std::size_t operation_offset = integer.value_offset + integer.value_length;
  if (operation_offset >= outer_end) {
    return ParseResult::kInvalid;
  }
  TlvView operation;
  parsed = ParseTlv(bytes, operation_offset, &operation);
  if (parsed != ParseResult::kComplete) {
    return parsed;
  }
  if (operation.value_offset + operation.value_length > outer_end) {
    return ParseResult::kInvalid;
  }
 
  message->op_tag = operation.tag;
  message->message_id = message_id;
  message->total_length = outer.total_length;
  message->sasl_mechanism_query = operation.tag == kSearchRequest &&
                                  IsSaslMechanismSearch(bytes.substr(operation.value_offset, operation.value_length));
  return ParseResult::kComplete;
}

void LdapMockServer::AppendBerLength(std::string* out, std::size_t length) {
  if (out == nullptr) {
    return;
  }
  if (length < 128) {
    out->push_back(static_cast<char>(length));
    return;
  }
 
  unsigned char encoded[sizeof(std::size_t)];
  std::size_t count = 0;
  while (length != 0) {
    encoded[count++] = static_cast<unsigned char>(length & 0xffU);
    length >>= 8U;
  }
  out->push_back(static_cast<char>(0x80U | count));
  while (count != 0) {
    out->push_back(static_cast<char>(encoded[--count]));
  }
}

void LdapMockServer::AppendTlv(std::string* out, unsigned char tag, std::string_view value) {
  if (out == nullptr) {
    return;
  }
  out->push_back(static_cast<char>(tag));
  AppendBerLength(out, value.size());
  out->append(value.data(), value.size());
}

void LdapMockServer::AppendBerInteger(std::string* out, std::uint32_t value) {
  unsigned char encoded[5];
  std::size_t count = 0;
  do {
    encoded[count++] = static_cast<unsigned char>(value & 0xffU);
    value >>= 8U;
  } while (value != 0);
 
  std::string bytes;
  if ((encoded[count - 1] & 0x80U) != 0) {
    bytes.push_back('\0');
  }
  while (count != 0) {
    bytes.push_back(static_cast<char>(encoded[--count]));
  }
  AppendTlv(out, kIntegerTag, bytes);
}

void LdapMockServer::BuildResultMessage(std::uint32_t message_id, unsigned char op_tag, int result_code,
                                        std::string* out) {
  if (out == nullptr) {
    return;
  }
 
  std::string result;
  const int bounded_code = std::max(0, std::min(result_code, 255));
  const char code_byte = static_cast<char>(bounded_code);
  AppendTlv(&result, kEnumeratedTag, std::string_view(&code_byte, 1));
  AppendTlv(&result, kOctetStringTag, std::string_view());
  AppendTlv(&result, kOctetStringTag, std::string_view());
 
  std::string content;
  AppendBerInteger(&content, message_id);
  AppendTlv(&content, op_tag, result);
 
  out->clear();
  AppendTlv(out, kSequenceTag, content);
}

void LdapMockServer::BuildSaslMechanismsEntry(std::uint32_t message_id, std::string* out) {
  if (out == nullptr) {
    return;
  }
 
  std::string values;
  AppendTlv(&values, kOctetStringTag, kPlainMechanism);
 
  std::string attribute;
  AppendTlv(&attribute, kOctetStringTag, kSupportedSaslMechanisms);
  AppendTlv(&attribute, kSetTag, values);
 
  std::string attributes;
  AppendTlv(&attributes, kSequenceTag, attribute);
 
  std::string entry;
  AppendTlv(&entry, kOctetStringTag, std::string_view());
  AppendTlv(&entry, kSequenceTag, attributes);
 
  std::string content;
  AppendBerInteger(&content, message_id);
  AppendTlv(&content, kSearchResultEntry, entry);
 
  out->clear();
  AppendTlv(out, kSequenceTag, content);
}

bool LdapMockServer::RewriteMessageId(std::string_view message, std::uint32_t message_id, std::string* out) {
  if (out == nullptr) {
    return false;
  }
 
  TlvView outer;
  if (ParseTlv(message, 0, &outer) != ParseResult::kComplete || outer.tag != kSequenceTag ||
      outer.total_length != message.size()) {
    return false;
  }
 
  TlvView integer;
  if (ParseTlv(message, outer.value_offset, &integer) != ParseResult::kComplete || integer.tag != kIntegerTag ||
      integer.value_offset + integer.value_length > outer.value_offset + outer.value_length) {
    return false;
  }
 
  std::string content;
  AppendBerInteger(&content, message_id);
  const std::size_t remainder_offset = integer.value_offset + integer.value_length;
  const std::size_t outer_end = outer.value_offset + outer.value_length;
  content.append(message.data() + remainder_offset, outer_end - remainder_offset);
 
  out->clear();
  AppendTlv(out, kSequenceTag, content);
  return true;
}

bool LdapMockServer::MessageOpTag(std::string_view message, unsigned char* op_tag) {
  if (op_tag == nullptr) {
    return false;
  }
  MessageView decoded;
  if (ParseMessage(message, &decoded) != ParseResult::kComplete || decoded.total_length != message.size()) {
    return false;
  }
  *op_tag = decoded.op_tag;
  return true;
}

void LdapMockServer::ResetForScenario(const curl::fuzzer::proto::Scenario& scenario) {
  connection_.reset();
  scenario_ = &scenario;
  server_chunk_count_ = std::min<std::size_t>(scenario_limits::kMaxResponseChunks,
                                              static_cast<std::size_t>(scenario.connection().on_readable_size()));
  next_server_chunk_ = 0;
  bind_request_count_ = 0;
  search_request_count_ = 0;
  mechanism_search_request_count_ = 0;
  starttls_request_count_ = 0;
  unbind_request_count_ = 0;
  server_message_count_ = 0;
  scripted_message_count_ = 0;
  synthesized_done_count_ = 0;
  scripted_bind_response_count_ = 0;
  pending_client_bytes_.clear();
  packet_transcript_.clear();
  search_message_id_ = 0;
  search_active_ = false;
  search_done_sent_ = false;
  scripted_bind_consumed_ = false;
  release_script_chunks_ = false;
  peer_closed_ = false;
  protocol_error_ = false;
  socket_opened_ = false;
}

void LdapMockServer::ApplyScriptBackpressure(MockConnection* connection,
                                             const curl::fuzzer::proto::Connection& script) {
  if (connection == nullptr) {
    return;
  }
 
  const std::uint32_t int_max = static_cast<std::uint32_t>(std::numeric_limits<int>::max());
  const auto& backpressure = script.backpressure();
  const int receive_buffer = static_cast<int>(std::min(backpressure.recv_buf_bytes(), int_max));
  connection->ApplyBackpressure(receive_buffer, static_cast<std::size_t>(backpressure.drain_limit()));
}

std::unique_ptr<MockConnection> LdapMockServer::CreateConnection() { return std::make_unique<MockConnection>(); }

curl_socket_t LdapMockServer::HandleOpenSocket(curlsocktype purpose, struct curl_sockaddr* /*address*/) {
  if (scenario_ == nullptr || purpose != CURLSOCKTYPE_IPCXN || socket_opened_) {
    return CURL_SOCKET_BAD;
  }
 
  connection_ = CreateConnection();
  if (!connection_ || !connection_->ok()) {
    connection_.reset();
    return CURL_SOCKET_BAD;
  }
  connection_->SetIncomingDataObserver(this);
 
  ApplyScriptBackpressure(connection_.get(), scenario_->connection());
  socket_opened_ = true;
  return connection_->take_client_fd();
}

void LdapMockServer::CapturePrefix(std::string_view source, std::size_t limit, std::string* destination) {
  if (destination == nullptr || destination->size() >= limit) {
    return;
  }
  const std::size_t available = limit - destination->size();
  destination->append(source.data(), std::min(source.size(), available));
}

bool LdapMockServer::WriteServerBytes(std::string_view bytes) {
  if (bytes.empty()) {
    return true;
  }
  const bool written = connection_ != nullptr &&
                       connection_->WriteAll(reinterpret_cast<const unsigned char*>(bytes.data()), bytes.size());
  if (written) {
    ++server_message_count_;
  }
  return written;
}

void LdapMockServer::HandleBindRequest(std::uint32_t message_id) {
  ++bind_request_count_;
 
  std::string response;
  if (!scripted_bind_consumed_ && scenario_ != nullptr && !scenario_->connection().initial_response().empty()) {
    const std::string& scripted = scenario_->connection().initial_response();
    if (!RewriteMessageId(scripted, message_id, &response)) {
      response = scripted;
    }
    scripted_bind_consumed_ = true;
    ++scripted_bind_response_count_;
  } else {
    BuildResultMessage(message_id, kBindResponse, kLdapSuccess, &response);
  }
  (void)WriteServerBytes(response);
}

void LdapMockServer::HandleSearchRequest(std::uint32_t message_id) {
  ++search_request_count_;
  search_message_id_ = message_id;
  search_active_ = true;
  search_done_sent_ = false;
  release_script_chunks_ = true;
  next_server_chunk_ = 0;
}

void LdapMockServer::HandleMechanismSearchRequest(std::uint32_t message_id) {
  ++search_request_count_;
  ++mechanism_search_request_count_;
 
  std::string entry;
  BuildSaslMechanismsEntry(message_id, &entry);
  (void)WriteServerBytes(entry);
 
  std::string done;
  BuildResultMessage(message_id, kSearchResultDone, kLdapSuccess, &done);
  ++synthesized_done_count_;
  (void)WriteServerBytes(done);
}

void LdapMockServer::HandleStartTlsRequest(std::uint32_t message_id) {
  ++starttls_request_count_;
  std::string response;
  BuildResultMessage(message_id, kExtendedResponse, kLdapSuccess, &response);
  (void)WriteServerBytes(response);
}

void LdapMockServer::HandleClientMessage(const MessageView& message) {
  switch (message.op_tag) {
    case kBindRequest:
      HandleBindRequest(message.message_id);
      return;
 
    case kSearchRequest:
      if (message.sasl_mechanism_query && bind_request_count_ == 0 && mechanism_search_request_count_ == 0) {
        HandleMechanismSearchRequest(message.message_id);
      } else {
        HandleSearchRequest(message.message_id);
      }
      return;
 
    case kExtendedRequest:
      HandleStartTlsRequest(message.message_id);
      return;
 
    case kUnbindRequest:
      ++unbind_request_count_;
      return;
 
    case kAbandonRequest:
      return;
 
    default:
      return;
  }
}

bool LdapMockServer::ReleaseNextServerChunk() {
  if (!release_script_chunks_ || scenario_ == nullptr || connection_ == nullptr ||
      next_server_chunk_ >= server_chunk_count_) {
    return false;
  }
 
  const std::string& chunk = scenario_->connection().on_readable(static_cast<int>(next_server_chunk_));
  ++next_server_chunk_;
 
  if (chunk.empty()) {
    connection_->ShutdownWrite();
    peer_closed_ = true;
    release_script_chunks_ = false;
    return true;
  }
 
  unsigned char op_tag = 0;
  const bool has_op_tag = MessageOpTag(chunk, &op_tag);
  std::string rewritten;
  const bool renumbered = RewriteMessageId(chunk, search_message_id_, &rewritten);
  const std::string_view bytes = renumbered ? std::string_view(rewritten) : std::string_view(chunk);
 
  ++scripted_message_count_;
  (void)WriteServerBytes(bytes);
  if (has_op_tag && op_tag == kSearchResultDone) {
    search_done_sent_ = true;
    release_script_chunks_ = false;
  }
  return true;
}

bool LdapMockServer::FinishSearchIfReady() {
  if (!search_active_ || search_done_sent_ || peer_closed_ || connection_ == nullptr) {
    return false;
  }
  if (release_script_chunks_ && next_server_chunk_ < server_chunk_count_) {
    return false;
  }
 
  std::string done;
  BuildResultMessage(search_message_id_, kSearchResultDone, kLdapSuccess, &done);
  ++synthesized_done_count_;
  search_done_sent_ = true;
  release_script_chunks_ = false;
  return WriteServerBytes(done);
}

bool LdapMockServer::ServiceClientConnection() {
  if (connection_ == nullptr || protocol_error_ || peer_closed_) {
    return false;
  }
 
  const std::size_t size_before_read = pending_client_bytes_.size();
  const std::size_t transport_progress = connection_->DrainIncoming();
  bool made_progress = pending_client_bytes_.size() != size_before_read || transport_progress != 0;
 
  std::size_t consumed = 0;
  int messages = 0;
  while (consumed < pending_client_bytes_.size() && messages < kMaxMessagesPerService) {
    const std::string_view available(pending_client_bytes_.data() + consumed, pending_client_bytes_.size() - consumed);
    MessageView message;
    const ParseResult parsed = ParseMessage(available, &message);
    if (parsed == ParseResult::kNeedMore) {
      break;
    }
    if (parsed == ParseResult::kInvalid) {
      protocol_error_ = true;
      break;
    }
 
    const std::string_view complete = available.substr(0, message.total_length);
    CapturePrefix(complete, kMaxCapturedMessageBytes, &packet_transcript_);
    HandleClientMessage(message);
    consumed += message.total_length;
    ++messages;
    made_progress = true;
  }
 
  if (protocol_error_) {
    pending_client_bytes_.clear();
    // Close the write half immediately so a bogus length cannot wait on the
    // idle budget for an impossible body.
    connection_->ShutdownWrite();
    release_script_chunks_ = false;
  } else if (consumed != 0) {
    pending_client_bytes_.erase(0, consumed);
  }
  return made_progress;
}

void LdapMockServer::FinishConnections() {
  if (connection_ != nullptr) {
    connection_->ShutdownWrite();
  }
}

void LdapMockServer::RunLoop(CURLM* multi, CURL* easy, const curl::fuzzer::proto::Scenario& scenario) {
  (void)easy;
  ResetForScenario(scenario);
 
  int still_running = 1;
  int idle_iterations = 0;
  int drive_iterations = 0;
  CURLMcode result = CURLM_OK;
  while (still_running && idle_iterations < kMaxIdleIterations && drive_iterations++ < kMaxDriveIterations) {
    const int running_before = still_running;
    result = curl_multi_perform(multi, &still_running);
    if (result != CURLM_OK) {
      break;
    }
 
    bool made_progress = still_running != running_before;
    made_progress = ServiceClientConnection() || made_progress;
    made_progress = ReleaseNextServerChunk() || made_progress;
    made_progress = FinishSearchIfReady() || made_progress;
    if (made_progress) {
      idle_iterations = 0;
    } else {
      ++idle_iterations;
    }
  }
 
  // The final perform may have emitted a request immediately before marking
  // the transfer done. Drain those bytes before cleanup.
  (void)ServiceClientConnection();
  (void)ReleaseNextServerChunk();
  (void)FinishSearchIfReady();
  FinishConnections();
  scenario_ = nullptr;
}

void LdapMockServer::ObserveState() {
#if defined(PROTO_FUZZER_OBSERVE_STATE)
  MockServerBase::ObserveState();
  const volatile std::size_t ldap_observation[] = {packet_transcript().size(), bind_request_count(),
                                                   search_request_count(),     scripted_message_count(),
                                                   synthesized_done_count(),   starttls_request_count()};
  (void)ldap_observation;
#endif
}
 
}  // namespace proto_fuzzer