Craig Tiller | 535701c | 2015-12-07 10:09:44 -0800 | [diff] [blame] | 1 | /* |
| 2 | * |
| 3 | * Copyright 2015, Google Inc. |
| 4 | * All rights reserved. |
| 5 | * |
| 6 | * Redistribution and use in source and binary forms, with or without |
| 7 | * modification, are permitted provided that the following conditions are |
| 8 | * met: |
| 9 | * |
| 10 | * * Redistributions of source code must retain the above copyright |
| 11 | * notice, this list of conditions and the following disclaimer. |
| 12 | * * Redistributions in binary form must reproduce the above |
| 13 | * copyright notice, this list of conditions and the following disclaimer |
| 14 | * in the documentation and/or other materials provided with the |
| 15 | * distribution. |
| 16 | * * Neither the name of Google Inc. nor the names of its |
| 17 | * contributors may be used to endorse or promote products derived from |
| 18 | * this software without specific prior written permission. |
| 19 | * |
| 20 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
| 21 | * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
| 22 | * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR |
| 23 | * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT |
| 24 | * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
| 25 | * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT |
| 26 | * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
| 27 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
| 28 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
| 29 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
| 30 | * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 31 | * |
| 32 | */ |
| 33 | |
| 34 | #include "test/core/bad_client/bad_client.h" |
| 35 | #include "src/core/surface/server.h" |
| 36 | |
| 37 | #define PFX_STR \ |
| 38 | "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n" \ |
| 39 | "\x00\x00\x00\x04\x00\x00\x00\x00\x00" |
| 40 | |
| 41 | static void verifier(grpc_server *server, grpc_completion_queue *cq) { |
| 42 | while (grpc_server_has_open_connections(server)) { |
| 43 | GPR_ASSERT(grpc_completion_queue_next( |
| 44 | cq, GRPC_TIMEOUT_MILLIS_TO_DEADLINE(20), NULL) |
| 45 | .type == GRPC_QUEUE_TIMEOUT); |
| 46 | } |
| 47 | } |
| 48 | |
| 49 | int main(int argc, char **argv) { |
| 50 | grpc_test_init(argc, argv); |
| 51 | |
| 52 | /* partial http2 header prefixes */ |
| 53 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR "\x00", |
| 54 | GRPC_BAD_CLIENT_DISCONNECT); |
| 55 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR "\x00\x00", |
| 56 | GRPC_BAD_CLIENT_DISCONNECT); |
| 57 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR "\x00\x00\x00", |
| 58 | GRPC_BAD_CLIENT_DISCONNECT); |
| 59 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR "\x00\x00\x00\x01", |
| 60 | GRPC_BAD_CLIENT_DISCONNECT); |
| 61 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR "\x00\x00\x00\x01\x00", |
| 62 | GRPC_BAD_CLIENT_DISCONNECT); |
| 63 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR "\x00\x00\x00\x01\x04", |
| 64 | GRPC_BAD_CLIENT_DISCONNECT); |
| 65 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR "\x00\x00\x00\x01\x05", |
| 66 | GRPC_BAD_CLIENT_DISCONNECT); |
| 67 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR "\x00\x00\x00\x01\x04\x00", |
| 68 | GRPC_BAD_CLIENT_DISCONNECT); |
| 69 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR "\x00\x00\x00\x01\x04\x00\x00", |
| 70 | GRPC_BAD_CLIENT_DISCONNECT); |
| 71 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR "\x00\x00\x00\x01\x04\x00\x00\x00", |
| 72 | GRPC_BAD_CLIENT_DISCONNECT); |
| 73 | GRPC_RUN_BAD_CLIENT_TEST(verifier, |
| 74 | PFX_STR "\x00\x00\x00\x01\x04\x00\x00\x00\x00", |
| 75 | GRPC_BAD_CLIENT_DISCONNECT); |
| 76 | GRPC_RUN_BAD_CLIENT_TEST(verifier, |
| 77 | PFX_STR "\x00\x00\x00\x01\x04\x00\x00\x00\x01", |
| 78 | GRPC_BAD_CLIENT_DISCONNECT); |
| 79 | |
| 80 | /* test adding prioritization data */ |
| 81 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR |
| 82 | "\x00\x00\x01\x01\x24\x00\x00\x00\x01" |
| 83 | "\x00", |
| 84 | 0); |
| 85 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR |
| 86 | "\x00\x00\x02\x01\x24\x00\x00\x00\x01" |
| 87 | "\x00\x00", |
| 88 | 0); |
| 89 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR |
| 90 | "\x00\x00\x03\x01\x24\x00\x00\x00\x01" |
| 91 | "\x00\x00\x00", |
| 92 | 0); |
| 93 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR |
| 94 | "\x00\x00\x04\x01\x24\x00\x00\x00\x01" |
| 95 | "\x00\x00\x00\x00", |
| 96 | 0); |
| 97 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR |
| 98 | "\x00\x00\x05\x01\x24\x00\x00\x00\x01" |
Craig Tiller | 85517c6 | 2015-12-07 21:15:17 -0800 | [diff] [blame] | 99 | "\x00", |
| 100 | GRPC_BAD_CLIENT_DISCONNECT); |
| 101 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR |
| 102 | "\x00\x00\x05\x01\x24\x00\x00\x00\x01" |
| 103 | "\x00\x00", |
| 104 | GRPC_BAD_CLIENT_DISCONNECT); |
| 105 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR |
| 106 | "\x00\x00\x05\x01\x24\x00\x00\x00\x01" |
| 107 | "\x00\x00\x00", |
| 108 | GRPC_BAD_CLIENT_DISCONNECT); |
| 109 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR |
| 110 | "\x00\x00\x05\x01\x24\x00\x00\x00\x01" |
| 111 | "\x00\x00\x00\x00", |
| 112 | GRPC_BAD_CLIENT_DISCONNECT); |
| 113 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR |
| 114 | "\x00\x00\x05\x01\x24\x00\x00\x00\x01" |
Craig Tiller | 535701c | 2015-12-07 10:09:44 -0800 | [diff] [blame] | 115 | "\x00\x00\x00\x00\x00", |
| 116 | GRPC_BAD_CLIENT_DISCONNECT); |
| 117 | |
| 118 | /* test looking up an invalid index */ |
| 119 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR |
| 120 | "\x00\x00\x01\x01\x04\x00\x00\x00\x01" |
| 121 | "\xfe", |
| 122 | 0); |
| 123 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR |
| 124 | "\x00\x00\x04\x01\x04\x00\x00\x00\x01" |
Craig Tiller | 85517c6 | 2015-12-07 21:15:17 -0800 | [diff] [blame] | 125 | "\x7f\x7f\x01""a", |
Craig Tiller | 535701c | 2015-12-07 10:09:44 -0800 | [diff] [blame] | 126 | 0); |
| 127 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR |
| 128 | "\x00\x00\x04\x01\x04\x00\x00\x00\x01" |
Craig Tiller | 85517c6 | 2015-12-07 21:15:17 -0800 | [diff] [blame] | 129 | "\x0f\x7f\x01""a", |
Craig Tiller | 535701c | 2015-12-07 10:09:44 -0800 | [diff] [blame] | 130 | 0); |
| 131 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR |
| 132 | "\x00\x00\x04\x01\x04\x00\x00\x00\x01" |
Craig Tiller | 85517c6 | 2015-12-07 21:15:17 -0800 | [diff] [blame] | 133 | "\x1f\x7f\x01""a", |
Craig Tiller | 535701c | 2015-12-07 10:09:44 -0800 | [diff] [blame] | 134 | 0); |
| 135 | /* test nvr, not indexed in static table */ |
| 136 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR |
| 137 | "\x00\x00\x03\x01\x04\x00\x00\x00\x01" |
Craig Tiller | 85517c6 | 2015-12-07 21:15:17 -0800 | [diff] [blame] | 138 | "\x01\x01""a", |
Craig Tiller | 535701c | 2015-12-07 10:09:44 -0800 | [diff] [blame] | 139 | GRPC_BAD_CLIENT_DISCONNECT); |
| 140 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR |
| 141 | "\x00\x00\x03\x01\x04\x00\x00\x00\x01" |
Craig Tiller | 85517c6 | 2015-12-07 21:15:17 -0800 | [diff] [blame] | 142 | "\x11\x01""a", |
Craig Tiller | 535701c | 2015-12-07 10:09:44 -0800 | [diff] [blame] | 143 | GRPC_BAD_CLIENT_DISCONNECT); |
| 144 | /* illegal op code */ |
| 145 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR |
| 146 | "\x00\x00\x01\x01\x04\x00\x00\x00\x01" |
| 147 | "\x80", |
| 148 | 0); |
| 149 | /* parse some long indices */ |
| 150 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR |
| 151 | "\x00\x00\x02\x01\x04\x00\x00\x00\x01" |
| 152 | "\xff\x00", |
| 153 | 0); |
| 154 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR |
| 155 | "\x00\x00\x03\x01\x04\x00\x00\x00\x01" |
| 156 | "\xff\x80\x00", |
| 157 | 0); |
| 158 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR |
| 159 | "\x00\x00\x04\x01\x04\x00\x00\x00\x01" |
| 160 | "\xff\x80\x80\x00", |
| 161 | 0); |
| 162 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR |
| 163 | "\x00\x00\x05\x01\x04\x00\x00\x00\x01" |
| 164 | "\xff\x80\x80\x80\x00", |
| 165 | 0); |
| 166 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR |
| 167 | "\x00\x00\x06\x01\x04\x00\x00\x00\x01" |
| 168 | "\xff\x80\x80\x80\x80\x00", |
| 169 | 0); |
| 170 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR |
| 171 | "\x00\x00\x07\x01\x04\x00\x00\x00\x01" |
| 172 | "\xff\x80\x80\x80\x80\x80\x00", |
| 173 | 0); |
| 174 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR |
| 175 | "\x00\x00\x08\x01\x04\x00\x00\x00\x01" |
| 176 | "\xff\x80\x80\x80\x80\x80\x80\x00", |
| 177 | 0); |
| 178 | /* end of headers mid-opcode */ |
| 179 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR |
| 180 | "\x00\x00\x01\x01\x04\x00\x00\x00\x01" |
| 181 | "\x01", |
| 182 | GRPC_BAD_CLIENT_DISCONNECT); |
| 183 | |
Craig Tiller | e219e02 | 2015-12-07 10:58:55 -0800 | [diff] [blame] | 184 | /* dynamic table size update: set to default */ |
| 185 | GRPC_RUN_BAD_CLIENT_TEST(verifier, |
| 186 | PFX_STR |
| 187 | "\x00\x00\x03\x01\x04\x00\x00\x00\x01" |
| 188 | "\x3f\xe1\x1f", |
| 189 | GRPC_BAD_CLIENT_DISCONNECT); |
| 190 | GRPC_RUN_BAD_CLIENT_TEST(verifier, |
| 191 | PFX_STR |
| 192 | "\x00\x00\x03\x01\x04\x00\x00\x00\x01" |
| 193 | "\x3f\xf1\x1f", |
| 194 | 0); |
| 195 | |
| 196 | /* non-ending header followed by continuation frame */ |
| 197 | GRPC_RUN_BAD_CLIENT_TEST(verifier, |
| 198 | PFX_STR |
| 199 | "\x00\x00\x00\x01\x00\x00\x00\x00\x01" |
| 200 | "\x00\x00\x00\x09\x04\x00\x00\x00\x01", |
| 201 | GRPC_BAD_CLIENT_DISCONNECT); |
| 202 | /* non-ending header followed by non-continuation frame */ |
| 203 | GRPC_RUN_BAD_CLIENT_TEST(verifier, |
| 204 | PFX_STR |
| 205 | "\x00\x00\x00\x01\x00\x00\x00\x00\x01" |
| 206 | "\x00\x00\x00\x00\x04\x00\x00\x00\x01", |
| 207 | 0); |
Craig Tiller | 09c2d6d | 2015-12-07 11:52:12 -0800 | [diff] [blame] | 208 | /* opening with a continuation frame */ |
| 209 | GRPC_RUN_BAD_CLIENT_TEST(verifier, |
| 210 | PFX_STR |
| 211 | "\x00\x00\x00\x09\x04\x00\x00\x00\x01", |
| 212 | 0); |
Craig Tiller | e219e02 | 2015-12-07 10:58:55 -0800 | [diff] [blame] | 213 | |
Craig Tiller | c321814 | 2015-12-08 08:30:39 -0800 | [diff] [blame] | 214 | /* an invalid header found with fuzzing */ |
| 215 | GRPC_RUN_BAD_CLIENT_TEST(verifier, |
| 216 | PFX_STR |
| 217 | "\x00\x00\x00\x01\x39\x67\xed\x1d\x64", |
| 218 | GRPC_BAD_CLIENT_DISCONNECT); |
| 219 | |
Craig Tiller | 25fd571 | 2015-12-09 08:58:47 -0800 | [diff] [blame] | 220 | /* a badly encoded timeout value */ |
| 221 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR |
| 222 | "\x00\x00\x19\x01\x04\x00\x00\x00\x01" |
| 223 | "\x10\x0cgrpc-timeout\x0a" |
| 224 | "15 seconds", |
| 225 | GRPC_BAD_CLIENT_DISCONNECT); |
| 226 | /* a badly encoded timeout value: twice (catches caching) */ |
| 227 | GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR |
| 228 | "\x00\x00\x19\x01\x04\x00\x00\x00\x01" |
| 229 | "\x10\x0cgrpc-timeout\x0a" |
| 230 | "15 seconds" |
| 231 | "\x00\x00\x19\x01\x04\x00\x00\x00\x03" |
| 232 | "\x10\x0cgrpc-timeout\x0a" |
| 233 | "15 seconds", |
| 234 | GRPC_BAD_CLIENT_DISCONNECT); |
| 235 | |
Craig Tiller | 535701c | 2015-12-07 10:09:44 -0800 | [diff] [blame] | 236 | return 0; |
| 237 | } |