transfer_session.cc

Go to the documentation of this file.

/*
 * Copyright (C) Max Dymond, <cmeister2@gmail.com>, et al.
 *
 * SPDX-License-Identifier: curl
 */

 
#include "proto_fuzzer/transfer_session.h"
 
#include <algorithm>
#include <cstddef>
#include <cstdint>
#include <utility>
 
#include "proto_fuzzer/api_lifecycle.h"
#include "proto_fuzzer/bounded_anonymous_input_file.h"
#include "proto_fuzzer/option_apply.h"
#include "proto_fuzzer/request_data.h"
#include "proto_fuzzer/scenario_limits.h"
 
namespace proto_fuzzer {
namespace {
 
constexpr char kDevNullPath[] = "/dev/null";
constexpr char kAltSvcOrigin[] = "altsvc-origin.test";
constexpr char kAltSvcLoopbackResolve[] = "*:80:127.0.1.127";

int AbortUnexpectedAltSvcResolve(void*, void*, void*) { return 1; }
 
bool HasCanonicalAltSvcAuthority(const std::string& host_path) {
  const std::size_t host_size = sizeof(kAltSvcOrigin) - 1;
  return host_path.compare(0, host_size, kAltSvcOrigin) == 0 &&
         (host_path.size() == host_size || host_path[host_size] == '/' || host_path[host_size] == '?' ||
          host_path[host_size] == '#');
}

void PrepareInputFile(const std::string& contents, std::size_t* remaining_bytes, BoundedAnonymousInputFile* input_file,
                      bool guard_netrc = false) {
  const std::size_t size = std::min(contents.size(), std::min(scenario_limits::kMaxFileInputBytes, *remaining_bytes));
  if (size == 0) {
    return;
  }
  if (guard_netrc) {
    // Retain a parser-neutral newline when curl's loader drops comment lines.
    // Charge only protobuf bytes to the shared budget, as before.
    std::string guarded_contents(1, '\n');
    guarded_contents.append(contents.data(), size);
    if (input_file->Write(reinterpret_cast<const std::uint8_t*>(guarded_contents.data()), guarded_contents.size())) {
      *remaining_bytes -= size;
    }
  } else if (input_file->Write(reinterpret_cast<const std::uint8_t*>(contents.data()), size)) {
    *remaining_bytes -= size;
  }
}
 
}  // namespace

struct TransferSession::ParserInputs {
  BoundedAnonymousInputFile file_source{scenario_limits::kMaxFileInputBytes};
  BoundedAnonymousInputFile cookie{scenario_limits::kMaxFileInputBytes};
  BoundedAnonymousInputFile altsvc{scenario_limits::kMaxFileInputBytes};
  BoundedAnonymousInputFile hsts{scenario_limits::kMaxFileInputBytes};
  BoundedAnonymousInputFile netrc{scenario_limits::kMaxFileInputBytes + 1};
  BoundedAnonymousInputFile crl{scenario_limits::kMaxFileInputBytes};
  BoundedAnonymousInputFile pinned_public_key{scenario_limits::kMaxFileInputBytes};
};
 
TransferSession::TransferSession() = default;
TransferSession::~TransferSession() { Close(); }

bool TransferSession::Initialize() {
  if (!easy_) {
    easy_.reset(curl_easy_init());
  }
  return easy_ != nullptr;
}

CURL* TransferSession::easy() const { return easy_.get(); }

void TransferSession::ApplyBaseline(const curl::fuzzer::proto::Scenario& scenario) {
  if (easy_) {
    // Apply the new pointer before releasing the previous list.
    connect_to_ = ApplyBaselineOptions(easy_.get(), scenario.scheme(), scenario.trace_ids(), scenario.trace_config());
  }
}

bool TransferSession::ResetConfiguration() {
  if (!easy_ || request_data_ || api_lifecycle_) {
    return false;
  }
  curl_easy_reset(easy_.get());
  connect_to_.reset();
  altsvc_resolve_.reset();
  return true;
}

bool TransferSession::PrepareInputFiles(const curl::fuzzer::proto::Scenario& scenario, ScenarioRunMode mode) {
  if (easy_) {
    return false;
  }
  if (mode != ScenarioRunMode::kFileCoverage && mode != ScenarioRunMode::kDeepHttpCoverage &&
      mode != ScenarioRunMode::kTlsCoverage) {
    return true;
  }
  parser_inputs_ = std::make_unique<ParserInputs>();
  if (mode == ScenarioRunMode::kFileCoverage) {
    const std::size_t size = std::min(scenario.file_source().size(), scenario_limits::kMaxFileInputBytes);
    return parser_inputs_->file_source.Write(reinterpret_cast<const std::uint8_t*>(scenario.file_source().data()),
                                             size);
  }
  std::size_t remaining_bytes = scenario_limits::kMaxFileInputTotalBytes;
  if (mode == ScenarioRunMode::kDeepHttpCoverage) {
    PrepareInputFile(scenario.cookie_file(), &remaining_bytes, &parser_inputs_->cookie);
    PrepareInputFile(scenario.altsvc_file(), &remaining_bytes, &parser_inputs_->altsvc);
    PrepareInputFile(scenario.hsts_file(), &remaining_bytes, &parser_inputs_->hsts);
    PrepareInputFile(scenario.netrc_file(), &remaining_bytes, &parser_inputs_->netrc, true);
  } else {
    PrepareInputFile(scenario.crl_file(), &remaining_bytes, &parser_inputs_->crl);
    PrepareInputFile(scenario.pinned_public_key_file(), &remaining_bytes, &parser_inputs_->pinned_public_key);
  }
  return true;
}

const char* TransferSession::FileSourcePath() const {
  return parser_inputs_ ? parser_inputs_->file_source.path() : nullptr;
}

void TransferSession::ApplyInputFiles() {
  if (!easy_ || !parser_inputs_) {
    return;
  }
  if (const char* path = parser_inputs_->cookie.path()) {
    (void)curl_easy_setopt(easy_.get(), CURLOPT_COOKIEFILE, path);
  }
  // Alt-Svc/HSTS use one option for input and cleanup output. Load first,
  // then restore the fixed sink; both loaders retain earlier file entries.
  if (const char* path = parser_inputs_->altsvc.path()) {
    (void)curl_easy_setopt(easy_.get(), CURLOPT_ALTSVC, path);
    (void)curl_easy_setopt(easy_.get(), CURLOPT_ALTSVC, kDevNullPath);
  }
  if (const char* path = parser_inputs_->hsts.path()) {
    (void)curl_easy_setopt(easy_.get(), CURLOPT_HSTS, path);
    (void)curl_easy_setopt(easy_.get(), CURLOPT_HSTS, kDevNullPath);
  }
  if (const char* path = parser_inputs_->netrc.path()) {
    (void)curl_easy_setopt(easy_.get(), CURLOPT_NETRC_FILE, path);
    (void)curl_easy_setopt(easy_.get(), CURLOPT_NETRC, CURL_NETRC_REQUIRED);
  }
  if (const char* path = parser_inputs_->crl.path()) {
    (void)curl_easy_setopt(easy_.get(), CURLOPT_CRLFILE, path);
  }
}

void TransferSession::ApplyPinnedPublicKeyFile() {
  if (!easy_ || !parser_inputs_) {
    return;
  }
  if (const char* path = parser_inputs_->pinned_public_key.path()) {
    (void)curl_easy_setopt(easy_.get(), CURLOPT_PINNEDPUBLICKEY, path);
  }
}

void TransferSession::ConfigureAltSvcRouting(const std::string& host_path) {
  if (!easy_ || !parser_inputs_ || parser_inputs_->altsvc.path() == nullptr ||
      !HasCanonicalAltSvcAuthority(host_path)) {
    return;
  }
  CurlSlistPtr resolve(curl_slist_append(nullptr, kAltSvcLoopbackResolve));
  if (!resolve || curl_easy_setopt(easy_.get(), CURLOPT_RESOLVE, resolve.get()) != CURLE_OK) {
    return;
  }
  // Adopt only after installation; failures leave the previous list alive.
  altsvc_resolve_ = std::move(resolve);
  if (curl_easy_setopt(easy_.get(), CURLOPT_RESOLVER_START_FUNCTION, &AbortUnexpectedAltSvcResolve) == CURLE_OK) {
    // CONNECT_TO takes precedence over Alt-Svc. Only detach it when the
    // wildcard host cache and fail-closed resolver callback are installed.
    (void)curl_easy_setopt(easy_.get(), CURLOPT_CONNECT_TO, nullptr);
  }
}

ScenarioRequestData* TransferSession::InstallRequestData(const curl::fuzzer::proto::Scenario& scenario,
                                                         bool apply_resolve_entries) {
  if (!easy_ || request_data_) {
    return nullptr;
  }
  request_data_.emplace(easy_.get(), scenario, apply_resolve_entries);
  return &*request_data_;
}

ApiLifecycle* TransferSession::InstallApiLifecycle(const curl::fuzzer::proto::ApiPlan& plan, std::string_view url) {
  if (!easy_ || api_lifecycle_) {
    return nullptr;
  }
  api_lifecycle_ = std::make_unique<ApiLifecycle>(easy_.get(), plan, url);
  return api_lifecycle_.get();
}

void TransferSession::Close() {
  request_data_.reset();
  easy_.reset();
  api_lifecycle_.reset();
  altsvc_resolve_.reset();
  connect_to_.reset();
  parser_inputs_.reset();
}
 
}  // namespace proto_fuzzer