15821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Copyright (c) 2012 The Chromium Authors. All rights reserved. 25821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Use of this source code is governed by a BSD-style license that can be 35821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// found in the LICENSE file. 45821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 55821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <algorithm> 65821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <sstream> 75821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <string> 85821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <vector> 95821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/basictypes.h" 112a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#include "base/files/file_path.h" 121320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci#include "base/files/file_util.h" 135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/json/json_reader.h" 145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/memory/scoped_ptr.h" 15eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch#include "base/time/time.h" 165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/values.h" 175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "net/base/address_list.h" 185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "net/base/dns_util.h" 195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "net/base/io_buffer.h" 205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "net/base/ip_endpoint.h" 215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "net/dns/dns_protocol.h" 225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "net/dns/dns_query.h" 235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "net/dns/dns_response.h" 245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)namespace { 265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void CrashDoubleFree(void) { 285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Cause ASAN to detect a double-free 295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) void *p = malloc(1); 305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(INFO) << "Allocated p=" << p << ". Double-freeing..."; 315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) free(p); 325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) free(p); 335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void CrashNullPointerDereference(void) { 365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Cause the program to segfault with a NULL pointer dereference 375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) int *p = NULL; 385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) *p = 0; 395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)bool FitsUint8(int num) { 425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return (num >= 0) && (num <= kuint8max); 435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)bool FitsUint16(int num) { 465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return (num >= 0) && (num <= kuint16max); 475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)bool ReadTestCase(const char* filename, 505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint16* id, std::string* qname, uint16* qtype, 515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::vector<char>* resp_buf, 525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) bool* crash_test) { 532a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) base::FilePath filepath = base::FilePath::FromUTF8Unsafe(filename); 545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string json; 5658537e28ecd584eab876aee8be7156509866d23aTorne (Richard Coles) if (!base::ReadFileToString(filepath, &json)) { 575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << filename << ": couldn't read file."; 585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 615d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) scoped_ptr<base::Value> value(base::JSONReader::Read(json)); 625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!value.get()) { 635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << filename << ": couldn't parse JSON."; 645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 677d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles) base::DictionaryValue* dict; 685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!value->GetAsDictionary(&dict)) { 695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << filename << ": test case is not a dictionary."; 705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) *crash_test = dict->HasKey("crash_test"); 745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (*crash_test) { 755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(INFO) << filename << ": crash_test is set!"; 765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return true; 775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) int id_int; 805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!dict->GetInteger("id", &id_int)) { 815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << filename << ": id is missing or not an integer."; 825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!FitsUint16(id_int)) { 855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << filename << ": id is out of range."; 865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) *id = static_cast<uint16>(id_int); 895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!dict->GetStringASCII("qname", qname)) { 915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << filename << ": qname is missing or not a string."; 925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) int qtype_int; 965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!dict->GetInteger("qtype", &qtype_int)) { 975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << filename << ": qtype is missing or not an integer."; 985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!FitsUint16(qtype_int)) { 1015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << filename << ": qtype is out of range."; 1025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 1035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) *qtype = static_cast<uint16>(qtype_int); 1055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1067d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles) base::ListValue* resp_list; 1075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!dict->GetList("response", &resp_list)) { 1085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << filename << ": response is missing or not a list."; 1095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 1105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) size_t resp_size = resp_list->GetSize(); 1135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) resp_buf->clear(); 1145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) resp_buf->reserve(resp_size); 1155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t i = 0; i < resp_size; i++) { 1165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) int resp_byte_int; 1175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if ((!resp_list->GetInteger(i, &resp_byte_int))) { 1185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << filename << ": response[" << i << "] is not an integer."; 1195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 1205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!FitsUint8(resp_byte_int)) { 1225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << filename << ": response[" << i << "] is out of range."; 1235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 1245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) resp_buf->push_back(static_cast<char>(resp_byte_int)); 1265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DCHECK(resp_buf->size() == resp_size); 1285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(INFO) << "Query: id=" << id_int << ", " 1305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) << "qname=" << *qname << ", " 1315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) << "qtype=" << qtype_int << ", " 1325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) << "resp_size=" << resp_size; 1335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return true; 1355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 1365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void RunTestCase(uint16 id, std::string& qname, uint16 qtype, 1385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::vector<char>& resp_buf) { 1395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) net::DnsQuery query(id, qname, qtype); 1405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) net::DnsResponse response; 1415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::copy(resp_buf.begin(), resp_buf.end(), response.io_buffer()->data()); 1425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!response.InitParse(resp_buf.size(), query)) { 1445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(INFO) << "InitParse failed."; 1455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return; 1465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) net::AddressList address_list; 1495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::TimeDelta ttl; 1505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) net::DnsResponse::Result result = response.ParseToAddressList( 1515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) &address_list, &ttl); 1525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (result != net::DnsResponse::DNS_PARSE_OK) { 1535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(INFO) << "ParseToAddressList failed: " << result; 1545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return; 1555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Print the response in one compact line. 1585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::stringstream result_line; 1595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) result_line << "Response: address_list={ "; 1605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (unsigned int i = 0; i < address_list.size(); i++) 1615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) result_line << address_list[i].ToString() << " "; 1625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) result_line << "}, ttl=" << ttl.InSeconds() << "s"; 1635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(INFO) << result_line.str(); 1655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 1665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)bool ReadAndRunTestCase(const char* filename) { 1685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint16 id = 0; 1695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string qname; 1705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint16 qtype = 0; 1715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::vector<char> resp_buf; 1725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) bool crash_test = false; 1735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(INFO) << "Test case: " << filename; 1755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // ReadTestCase will print a useful error message if it fails. 1775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!ReadTestCase(filename, &id, &qname, &qtype, &resp_buf, &crash_test)) 1785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 1795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (crash_test) { 1815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(INFO) << "Crashing."; 1825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CrashDoubleFree(); 1835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // if we're not running under ASAN, that might not have worked 1845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CrashNullPointerDereference(); 1855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NOTREACHED(); 1865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return true; 1875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string qname_dns; 1905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!net::DNSDomainFromDot(qname, &qname_dns)) { 1915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) LOG(ERROR) << filename << ": DNSDomainFromDot(" << qname << ") failed."; 1925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 1935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) RunTestCase(id, qname_dns, qtype, resp_buf); 1965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return true; 1985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 1995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 2015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)int main(int argc, char** argv) { 2035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) int ret = 0; 2045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (int i = 1; i < argc; i++) 2065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!ReadAndRunTestCase(argv[i])) 2075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ret = 2; 2085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Cluster-Fuzz likes "#EOF" as the last line of output to help distinguish 2105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // successful runs from crashes. 2115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) printf("#EOF\n"); 2125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return ret; 2145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 2155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 216