option_apply.cc

Go to the documentation of this file.

/*
 * Copyright (C) Max Dymond, <cmeister2@gmail.com>, et al.
 *
 * SPDX-License-Identifier: curl
 */

 
#include "proto_fuzzer/option_apply.h"
 
#include <algorithm>
#include <cstddef>
#include <cstdint>
#include <cstdio>
#include <cstdlib>
#include <string>
 
#include "proto_fuzzer/allocation_fault_injection.h"
#include "proto_fuzzer/scenario_limits.h"
 
namespace proto_fuzzer {
 
namespace {
 
constexpr char kEventDrivenProtocolsAllowed[] = "http,https,ws,wss";
constexpr char kTelnetProtocolAllowed[] = "telnet";
constexpr char kFtpProtocolAllowed[] = "ftp,ftps";
constexpr char kTftpProtocolAllowed[] = "tftp";
constexpr char kSmtpProtocolAllowed[] = "smtp,smtps";
constexpr char kImapProtocolAllowed[] = "imap,imaps";
constexpr char kPop3ProtocolAllowed[] = "pop3,pop3s";
constexpr char kMqttProtocolAllowed[] = "mqtt,mqtts";
constexpr char kDictProtocolAllowed[] = "dict";
constexpr char kFileProtocolAllowed[] = "file";
constexpr char kLdapProtocolAllowed[] = "ldap,ldaps";
constexpr char kRtspProtocolAllowed[] = "rtsp";
constexpr char kConnectToOverride[] = "::127.0.1.127:";
constexpr char kDevNull[] = "/dev/null";
constexpr char kDefaultProvider[] = "default";
constexpr char kEngineCertificateType[] = "ENG";
constexpr char kPkcs12CertificateType[] = "P12";
constexpr char kProviderCertificateType[] = "PROV";
constexpr unsigned char kMalformedPkcs12[] = {0x30, 0x00};
constexpr char kVerboseEnvVar[] = "FUZZ_VERBOSE";
constexpr char kAltSvcHttpEnvVar[] = "CURL_ALTSVC_HTTP";
constexpr char kHstsHttpEnvVar[] = "CURL_HSTS_HTTP";
constexpr long kConnectTimeoutMs = 200;
constexpr long kTimeoutMs = 200;

size_t SilentWriteCallback(void* /*contents*/, size_t size, size_t nmemb, void* /*userdata*/) { return size * nmemb; }

int SilentDebugCallback(CURL* /*handle*/, curl_infotype /*type*/, char* /*data*/, size_t /*size*/, void* /*userdata*/) {
  return 0;
}

void EnableDebugHttpTransportMetadata() {
  static const bool configured = [] {
    // CMake builds the fuzzing copy of curl with ENABLE_DEBUG specifically so
    // these curl-provided test hooks are available. Do not overwrite values a
    // reproducer deliberately supplied in its environment.
    (void)setenv(kAltSvcHttpEnvVar, "1", 0);
    (void)setenv(kHstsHttpEnvVar, "1", 0);
    return true;
  }();
  (void)configured;
}
 
void EnableTraceIds() { (void)curl_global_trace("+LIB-IDS"); }
 
}  // namespace

CurlSlistPtr ApplyBaselineOptions(CURL* easy, curl::fuzzer::proto::Scheme scheme, bool trace_ids,
                                  const std::string& trace_config) {
  EnableDebugHttpTransportMetadata();
 
  curl_easy_setopt(easy, CURLOPT_WRITEFUNCTION, &SilentWriteCallback);
  curl_easy_setopt(easy, CURLOPT_HEADERFUNCTION, &SilentWriteCallback);
 
  const bool user_requested_verbose = std::getenv(kVerboseEnvVar) != nullptr;
  if (!trace_config.empty()) {
    // Apply the fuzzer-selected categories before any explicit trace-ID
    // request so a scenario cannot accidentally disable its own ID prefixes.
    (void)curl_global_trace(trace_config.c_str());
  }
  if (trace_ids) {
    EnableTraceIds();
  }
  if (trace_ids || !trace_config.empty()) {
    // Keep trace coverage enabled during fuzzing without flooding the process
    // log. The callback still executes curl_trc.c's formatting path. A stable
    // ignored userdata pointer also lets internal DoH handles exercise the
    // public debug-data propagation path without adding per-input ownership.
    curl_easy_setopt(easy, CURLOPT_DEBUGFUNCTION, &SilentDebugCallback);
    curl_easy_setopt(easy, CURLOPT_DEBUGDATA, easy);
    curl_easy_setopt(easy, CURLOPT_VERBOSE, 1L);
  } else if (scheme == curl::fuzzer::proto::SCHEME_TELNET && !user_requested_verbose) {
    // printoption() and printsub() contain a substantial part of curl's TELNET
    // parser diagnostics but run only in verbose mode. Keep those paths in the
    // ordinary TELNET coverage lane while suppressing their high-volume text.
    // An explicit FUZZ_VERBOSE still skips the sink so reproductions remain
    // inspectable from the terminal.
    curl_easy_setopt(easy, CURLOPT_DEBUGFUNCTION, &SilentDebugCallback);
    curl_easy_setopt(easy, CURLOPT_VERBOSE, 1L);
  }
 
  // Each non-HTTP protocol must use its dedicated peer invariants. Keep them
  // out of the redirect allowlist so an HTTP response cannot switch a stream
  // mock into synchronous TELNET, two-channel FTP, or datagram TFTP semantics.
  // CURLOPT_PROTOCOLS_STR arrived in 7.85.0.
  const char* direct_protocols = kEventDrivenProtocolsAllowed;
  switch (scheme) {
    case curl::fuzzer::proto::SCHEME_TELNET:
      direct_protocols = kTelnetProtocolAllowed;
      break;
    case curl::fuzzer::proto::SCHEME_FTP:
    case curl::fuzzer::proto::SCHEME_FTPS:
      direct_protocols = kFtpProtocolAllowed;
      break;
    case curl::fuzzer::proto::SCHEME_TFTP:
      direct_protocols = kTftpProtocolAllowed;
      break;
    case curl::fuzzer::proto::SCHEME_SMTP:
    case curl::fuzzer::proto::SCHEME_SMTPS:
      direct_protocols = kSmtpProtocolAllowed;
      break;
    case curl::fuzzer::proto::SCHEME_IMAP:
    case curl::fuzzer::proto::SCHEME_IMAPS:
      direct_protocols = kImapProtocolAllowed;
      break;
    case curl::fuzzer::proto::SCHEME_POP3:
    case curl::fuzzer::proto::SCHEME_POP3S:
      direct_protocols = kPop3ProtocolAllowed;
      break;
    case curl::fuzzer::proto::SCHEME_MQTT:
    case curl::fuzzer::proto::SCHEME_MQTTS:
      direct_protocols = kMqttProtocolAllowed;
      break;
    case curl::fuzzer::proto::SCHEME_DICT:
      direct_protocols = kDictProtocolAllowed;
      break;
    case curl::fuzzer::proto::SCHEME_GOPHER:
      direct_protocols = "gopher";
      break;
    case curl::fuzzer::proto::SCHEME_GOPHERS:
      direct_protocols = "gophers";
      break;
    case curl::fuzzer::proto::SCHEME_FILE:
      direct_protocols = kFileProtocolAllowed;
      break;
    case curl::fuzzer::proto::SCHEME_LDAP:
    case curl::fuzzer::proto::SCHEME_LDAPS:
      direct_protocols = kLdapProtocolAllowed;
      break;
    case curl::fuzzer::proto::SCHEME_RTSP:
      direct_protocols = kRtspProtocolAllowed;
      break;
    case curl::fuzzer::proto::SCHEME_HTTP:
    case curl::fuzzer::proto::SCHEME_HTTPS:
    case curl::fuzzer::proto::SCHEME_WS:
    case curl::fuzzer::proto::SCHEME_WSS:
    case curl::fuzzer::proto::SCHEME_IPFS:
    case curl::fuzzer::proto::SCHEME_IPNS:
    case curl::fuzzer::proto::SCHEME_UNSPECIFIED:
    default:
      break;
  }
  curl_easy_setopt(easy, CURLOPT_PROTOCOLS_STR, direct_protocols);
  curl_easy_setopt(easy, CURLOPT_REDIR_PROTOCOLS_STR, kEventDrivenProtocolsAllowed);
 
  // CONNECT_TO confines direct connections, but an ambient http_proxy or
  // ALL_PROXY can select a proxy before curl asks the harness for a socket.
  // An explicit empty proxy keeps every transfer inside the socketpair and
  // makes replay independent of the machine running the fuzzer.
  curl_easy_setopt(easy, CURLOPT_PROXY, "");
 
  // Keep raw secure-scheme inputs independent of the host trust store. The
  // dedicated TLS mock installs its own in-memory trust anchor after this
  // baseline; scenario options still run last and can deliberately select
  // verification failures.
  curl_easy_setopt(easy, CURLOPT_SSL_VERIFYPEER, 0L);
 
  // Force every name lookup to the fuzzer's in-process mock peer. The returned
  // owner keeps the list alive through curl_easy_cleanup.
  CurlSlistPtr connect_to(curl_slist_append(nullptr, kConnectToOverride));
  curl_easy_setopt(easy, CURLOPT_CONNECT_TO, connect_to.get());
 
  // Short bounds: fuzzing should never sit waiting on real I/O. Response
  // volume is already bounded by libFuzzer's input-size limit, so do not rate
  // limit receive traffic here: a global bytes-per-second throttle turns every
  // otherwise-complete large response into wall-clock sleep.
  curl_easy_setopt(easy, CURLOPT_CONNECTTIMEOUT_MS, kConnectTimeoutMs);
  curl_easy_setopt(easy, CURLOPT_TIMEOUT_MS, kTimeoutMs);
 
  // Keep every persistence/read path deterministic and prevent scenarios from
  // leaking state onto the filesystem. COOKIEFILE also makes the in-memory
  // engine's RELOAD command traverse its loader against a harmless empty
  // source. These path options deliberately remain absent from the generated
  // mutation manifest, so a proto cannot replace /dev/null.
  curl_easy_setopt(easy, CURLOPT_COOKIEJAR, kDevNull);
  curl_easy_setopt(easy, CURLOPT_COOKIEFILE, kDevNull);
  curl_easy_setopt(easy, CURLOPT_ALTSVC, kDevNull);
  curl_easy_setopt(easy, CURLOPT_HSTS, kDevNull);
  curl_easy_setopt(easy, CURLOPT_NETRC_FILE, kDevNull);
  // Do not set CRLFILE to a placeholder path. An empty CRL is
  // not a harmless sink: when a scenario restores certificate verification,
  // OpenSSL rejects /dev/null before it can exercise useful handshake and
  // verification paths. The option is absent from the mutation manifest, so
  // leaving it unset introduces neither filesystem writes nor external input.
 
  // FUZZ_VERBOSE in the environment flips curl's own verbose logging on. This
  // is useful when reproducing a crashing corpus entry.
  if (user_requested_verbose) {
    curl_easy_setopt(easy, CURLOPT_VERBOSE, 1L);
  }
  return connect_to;
}

CURLcode ApplyTlsClientCredentialProfile(CURL* easy, curl::fuzzer::proto::TlsClientCredentialProfile profile) {
  if (easy == nullptr) {
    return CURLE_BAD_FUNCTION_ARGUMENT;
  }
 
  const auto set_string = [easy](CURLoption option, const char* value) {
    return curl_easy_setopt(easy, option, value);
  };
  switch (profile) {
    case curl::fuzzer::proto::TLS_CLIENT_CREDENTIAL_NONE:
      return CURLE_OK;
 
    case curl::fuzzer::proto::TLS_CLIENT_CREDENTIAL_MALFORMED_PKCS12: {
      CURLcode result = set_string(CURLOPT_SSLCERTTYPE, kPkcs12CertificateType);
      if (result != CURLE_OK) {
        return result;
      }
      const curl_blob blob = {const_cast<unsigned char*>(kMalformedPkcs12), sizeof(kMalformedPkcs12), CURL_BLOB_COPY};
      return curl_easy_setopt(easy, CURLOPT_SSLCERT_BLOB, &blob);
    }
 
    case curl::fuzzer::proto::TLS_CLIENT_CREDENTIAL_ENGINE_DEV_NULL: {
      CURLcode result = set_string(CURLOPT_SSLCERTTYPE, kEngineCertificateType);
      if (result != CURLE_OK) {
        return result;
      }
      return set_string(CURLOPT_SSLCERT, kDevNull);
    }
 
    case curl::fuzzer::proto::TLS_CLIENT_CREDENTIAL_DEFAULT_PROVIDER_DEV_NULL: {
      CURLcode result = set_string(CURLOPT_SSLENGINE, kDefaultProvider);
      if (result != CURLE_OK) {
        return result;
      }
      result = set_string(CURLOPT_SSLCERTTYPE, kProviderCertificateType);
      if (result != CURLE_OK) {
        return result;
      }
      return set_string(CURLOPT_SSLCERT, kDevNull);
    }
 
    case curl::fuzzer::proto::TLS_CLIENT_CREDENTIAL_UNLOADED_PROVIDER_DEV_NULL: {
      CURLcode result = set_string(CURLOPT_SSLCERTTYPE, kProviderCertificateType);
      if (result != CURLE_OK) {
        return result;
      }
      return set_string(CURLOPT_SSLCERT, kDevNull);
    }
 
    default:
      return CURLE_BAD_FUNCTION_ARGUMENT;
  }
}

CURLcode ApplySetOption(CURL* easy, const curl::fuzzer::proto::SetOption& option) {
  const OptionDescriptor* desc = LookupOptionDescriptor(option.option_id());
  if (desc == nullptr) {
    return CURLE_UNKNOWN_OPTION;
  }
  const CURLoption curlopt = static_cast<CURLoption>(desc->curlopt);
 
  switch (desc->kind) {
    case OptionValueKind::kString: {
      const std::string& value = option.string_value();
 
      // COPYPOSTFIELDS allocates after reading the separately configured
      // POSTFIELDSIZE. First install the same protobuf-owned bytes as a
      // no-allocation borrowed fallback. A genuine OOM then still leaves a
      // coherent pointer and length for later consumers such as AWS SigV4.
      if (desc->curlopt == CURLOPT_COPYPOSTFIELDS) {
        CURLcode result = curl_easy_setopt(easy, CURLOPT_POSTFIELDS, value.c_str());
        if (result != CURLE_OK) {
          return result;
        }
      }
 
      // POSTFIELDS borrows its pointer and COPYPOSTFIELDS copies exactly the
      // previously configured size. Apply the correlated byte length first so
      // either option accepts embedded NULs without strlen semantics and the
      // copying variant can never read beyond the protobuf-owned buffer.
      if (desc->curlopt == CURLOPT_POSTFIELDS || desc->curlopt == CURLOPT_COPYPOSTFIELDS) {
        CURLcode result = curl_easy_setopt(easy, CURLOPT_POSTFIELDSIZE_LARGE, static_cast<curl_off_t>(value.size()));
        if (result != CURLE_OK) {
          return result;
        }
      }
 
      if (desc->curlopt == CURLOPT_COPYPOSTFIELDS) {
        // Copy ownership is a harness invariant rather than an allocation-
        // failure target. Preserve pending ordinals for later injectable work.
        allocation_fault_injection::ScopedFailureSuppression suppress_failures;
        return curl_easy_setopt(easy, CURLOPT_COPYPOSTFIELDS, value.c_str());
      }
 
      // Curl otherwise treats this option as a filename during the TLS
      // handshake. Fixed-policy inputs normally arrive pre-constrained by the
      // postprocessor; this runtime check also protects compatibility inputs,
      // which intentionally bypass it. Curl copies this option in setopt, so
      // the temporary remains valid for the call's full ownership contract.
      if (desc->curlopt == CURLOPT_PINNEDPUBLICKEY && !UsesInMemoryPublicKeyPin(value)) {
        std::string constrained = value;
        ConstrainPinnedPublicKeyValue(&constrained);
        return curl_easy_setopt(easy, curlopt, constrained.c_str());
      }
 
      return curl_easy_setopt(easy, curlopt, value.c_str());
    }
 
    // Decode the uint_value and pass it as either a long or a curl_off_t depending on the option.
    case OptionValueKind::kUint: {
      const std::uint64_t raw = DecodeIntegralOptionValue(*desc, option);
      // CURLOPTTYPE_OFF_T options start at 30000. Everything below takes a
      // long; everything at/above takes a curl_off_t.
      if (static_cast<int>(desc->curlopt) >= 30000) {
        return curl_easy_setopt(easy, curlopt, static_cast<curl_off_t>(raw));
      }
      return curl_easy_setopt(easy, curlopt, static_cast<long>(raw));
    }
 
    // Decode the bool_value and pass it as a long flag (0 or 1).
    case OptionValueKind::kBool: {
      const long flag = static_cast<long>(DecodeIntegralOptionValue(*desc, option));
      return curl_easy_setopt(easy, curlopt, flag);
    }
  }
  return CURLE_UNKNOWN_OPTION;
}

std::size_t RuntimeOptionCount(const curl::fuzzer::proto::Scenario& scenario) {
  return std::min<std::size_t>(static_cast<std::size_t>(scenario.options_size()), scenario_limits::kMaxOptions);
}

std::size_t ApplyScenarioOptions(CURL* easy, const curl::fuzzer::proto::Scenario& scenario) {
  const std::size_t option_count = RuntimeOptionCount(scenario);
  for (std::size_t index = 0; index < option_count; ++index) {
    (void)ApplySetOption(easy, scenario.options(static_cast<int>(index)));
  }
  return option_count;
}
 
}  // namespace proto_fuzzer