fuzz: added fuzz test for listener filter http_inspector

test/extensions/filters/listener/common/fuzz/BUILD

@@ -19,9 +19,20 @@ envoy_cc_test_library(
     srcs = ["listener_filter_fuzzer.cc"],
     hdrs = ["listener_filter_fuzzer.h"],
     deps = [
+        ":listener_filter_fakes",
         ":listener_filter_fuzzer_proto_cc_proto",
         "//include/envoy/network:filter_interface",
-        "//test/mocks/network:network_fakes",
+        "//test/mocks/network:network_mocks",
+        "//test/test_common:threadsafe_singleton_injector_lib",
+    ],
+)
+
+envoy_cc_test_library(
+    name = "listener_filter_fakes",
+    hdrs = ["listener_filter_fakes.h"],
+    deps = [
+        "//source/common/api:os_sys_calls_lib",
+        "//test/mocks/event:event_mocks",
         "//test/mocks/network:network_mocks",
     ],
 )

test/extensions/filters/listener/common/fuzz/listener_filter_fakes.h

@@ -0,0 +1,95 @@
+#include "common/api/os_sys_calls_impl.h"
+#include "common/network/io_socket_handle_impl.h"
+#include "common/network/utility.h"
+
+#include "test/mocks/network/mocks.h"
+
+#include "gmock/gmock.h"
+
+namespace Envoy {
+namespace Extensions {
+namespace ListenerFilters {
+
+class FakeConnectionSocket : public Network::MockConnectionSocket {
+public:
+  FakeConnectionSocket()
+      : io_handle_(std::make_unique<Network::IoSocketHandleImpl>(42)), local_address_(nullptr),
+        remote_address_(nullptr) {}
+
+  ~FakeConnectionSocket() override { io_handle_->close(); }
+
+  Network::IoHandle& ioHandle() override { return *io_handle_; }
+
+  const Network::IoHandle& ioHandle() const override { return *io_handle_; }
+
+  void setLocalAddress(const Network::Address::InstanceConstSharedPtr& local_address) override {
+    local_address_ = local_address;
+    if (local_address_ != nullptr) {
+      addr_type_ = local_address_->type();
+    }
+  }
+
+  void setRemoteAddress(const Network::Address::InstanceConstSharedPtr& remote_address) override {
+    remote_address_ = remote_address;
+  }
+
+  const Network::Address::InstanceConstSharedPtr& localAddress() const override {
+    return local_address_;
+  }
+
+  const Network::Address::InstanceConstSharedPtr& remoteAddress() const override {
+    return remote_address_;
+  }
+
+  Network::Address::Type addressType() const override { return addr_type_; }
+
+  absl::optional<Network::Address::IpVersion> ipVersion() const override {
+    if (addr_type_ != Network::Address::Type::Ip) {
+      return absl::nullopt;
+    }
+
+    return local_address_->ip()->version();
+  }
+
+  void setRequestedApplicationProtocols(const std::vector<absl::string_view>& protocols) override {
+    application_protocols_.clear();
+    for (const auto& protocol : protocols) {
+      application_protocols_.emplace_back(protocol);
+    }
+  }
+
+  const std::vector<std::string>& requestedApplicationProtocols() const override {
+    return application_protocols_;
+  }
+
+  Api::SysCallIntResult getSocketOption(int level, int, void* optval, socklen_t*) const override {
+    switch (level) {
+    case SOL_IPV6:
+      static_cast<sockaddr_storage*>(optval)->ss_family = AF_INET6;
+      break;
+    case SOL_IP:
+      static_cast<sockaddr_storage*>(optval)->ss_family = AF_INET;
+      break;
+    default:
+      NOT_REACHED_GCOVR_EXCL_LINE;
+    }
+
+    return Api::SysCallIntResult{0, 0};
+  }
+
+private:
+  const Network::IoHandlePtr io_handle_;
+  Network::Address::InstanceConstSharedPtr local_address_;
+  Network::Address::InstanceConstSharedPtr remote_address_;
+  Network::Address::Type addr_type_;
+  std::vector<std::string> application_protocols_;
+};
+
+class FakeOsSysCalls : public Api::OsSysCallsImpl {
+public:
+  MOCK_METHOD(Api::SysCallSizeResult, recv, (os_fd_t, void*, size_t, int));
+};
+
+} // namespace ListenerFilters
+} // namespace Extensions
+} // namespace Envoy

test/extensions/filters/listener/common/fuzz/listener_filter_fuzzer.cc

@@ -1,7 +1,5 @@
 #include "test/extensions/filters/listener/common/fuzz/listener_filter_fuzzer.h"
 
-#include "common/network/utility.h"
-
 namespace Envoy {
 namespace Extensions {
 namespace ListenerFilters {
@@ -10,19 +8,85 @@ void ListenerFilterFuzzer::fuzz(
     Network::ListenerFilter& filter,
     const test::extensions::filters::listener::FilterFuzzTestCase& input) {
   try {
-    fuzzerSetup(input);
+    socket_.setLocalAddress(Network::Utility::resolveUrl(input.sock().local_address()));
+  } catch (const EnvoyException& e) {
+    // If fuzzed local address is malformed or missing, socket's local address will be nullptr
+  }
+  try {
+    socket_.setRemoteAddress(Network::Utility::resolveUrl(input.sock().remote_address()));
   } catch (const EnvoyException& e) {
-    ENVOY_LOG_MISC(debug, "EnvoyException: {}", e.what());
-    return;
+    // If fuzzed remote address is malformed or missing, socket's remote address will be nullptr
+  }
+
+  const int nreads = input.data_size(); // Number of reads
+
+  if (nreads > 0) {
+    EXPECT_CALL(socket_, detectedTransportProtocol()).WillRepeatedly(testing::Return("raw_buffer"));
+
+    EXPECT_CALL(os_sys_calls_, recv(42, _, _, MSG_PEEK))
+        .WillOnce(testing::Return(Api::SysCallSizeResult{static_cast<ssize_t>(0), 0}));
+
+    EXPECT_CALL(dispatcher_,
+                createFileEvent_(_, _, Event::FileTriggerType::Edge,
+                                 Event::FileReadyType::Read | Event::FileReadyType::Closed))
+        .WillOnce(testing::DoAll(testing::SaveArg<1>(&file_event_callback_),
+                                 testing::ReturnNew<NiceMock<Event::MockFileEvent>>()));
   }
 
   filter.onAccept(cb_);
-}
 
-void ListenerFilterFuzzer::socketSetup(
-    const test::extensions::filters::listener::FilterFuzzTestCase& input) {
-  socket_.setLocalAddress(Network::Utility::resolveUrl(input.sock().local_address()));
-  socket_.setRemoteAddress(Network::Utility::resolveUrl(input.sock().remote_address()));
+  if (nreads > 0) {
+    // Construct header from single or multiple reads
+    std::string data = "";
+    std::vector<size_t> indices; // Ending indices for each read
+
+    size_t curr = 0;
+
+    for (int i = 0; i < nreads; i++) {
+      data += input.data(i);
+      curr += input.data(i).size();
+      indices.push_back(curr);
+    }
+
+    absl::string_view header(data);
+
+    int nread = 0; // Counter of current read
+
+    {
+      testing::InSequence s;
+
+      if (nreads > 1) {
+        EXPECT_CALL(os_sys_calls_, recv(42, _, _, MSG_PEEK))
+            .WillOnce(testing::InvokeWithoutArgs([]() {
+              return Api::SysCallSizeResult{ssize_t(-1), SOCKET_ERROR_AGAIN};
+            }));
+      }
+
+      EXPECT_CALL(os_sys_calls_, recv(42, _, _, MSG_PEEK))
+          .Times(testing::AnyNumber())
+          .WillRepeatedly(Invoke([&header, &indices, &nread](os_fd_t, void* buffer, size_t length,
+                                                             int) -> Api::SysCallSizeResult {
+            ASSERT(length >= indices[nread]);
+            memcpy(buffer, header.data(), indices[nread]);
+            return Api::SysCallSizeResult{ssize_t(indices[nread++]), 0};
+          }));
+    }
+
+    bool got_continue = false;
+
+    ON_CALL(cb_, continueFilterChain(true))
+        .WillByDefault(testing::InvokeWithoutArgs([&got_continue]() { got_continue = true; }));
+
+    while (!got_continue) {
+      if (nread >= nreads) { // End of stream reached but not done
+        nread--;             // Decrement to avoid out-of-range for last recv() call
+        file_event_callback_(Event::FileReadyType::Closed);
+        break;
+      } else {
+        file_event_callback_(Event::FileReadyType::Read);
+      }
+    }
+  }
 }
 
 } // namespace ListenerFilters

test/extensions/filters/listener/common/fuzz/listener_filter_fuzzer.h

@@ -1,8 +1,10 @@
 #include "envoy/network/filter.h"
 
+#include "test/extensions/filters/listener/common/fuzz/listener_filter_fakes.h"
 #include "test/extensions/filters/listener/common/fuzz/listener_filter_fuzzer.pb.validate.h"
-#include "test/mocks/network/fakes.h"
+#include "test/mocks/event/mocks.h"
 #include "test/mocks/network/mocks.h"
+#include "test/test_common/threadsafe_singleton_injector.h"
 
 #include "gmock/gmock.h"
 
@@ -12,19 +14,21 @@ namespace ListenerFilters {
 
 class ListenerFilterFuzzer {
 public:
-  void fuzz(Network::ListenerFilter& filter,
-            const test::extensions::filters::listener::FilterFuzzTestCase& input);
-
-private:
-  void fuzzerSetup(const test::extensions::filters::listener::FilterFuzzTestCase& input) {
+  ListenerFilterFuzzer() {
     ON_CALL(cb_, socket()).WillByDefault(testing::ReturnRef(socket_));
-    socketSetup(input);
+    ON_CALL(cb_, dispatcher()).WillByDefault(testing::ReturnRef(dispatcher_));
   }
 
-  void socketSetup(const test::extensions::filters::listener::FilterFuzzTestCase& input);
+  void fuzz(Network::ListenerFilter& filter,
+            const test::extensions::filters::listener::FilterFuzzTestCase& input);
 
+private:
+  FakeOsSysCalls os_sys_calls_;
+  TestThreadsafeSingletonInjector<Api::OsSysCallsImpl> os_calls_{&os_sys_calls_};
   NiceMock<Network::MockListenerFilterCallbacks> cb_;
-  Network::FakeConnectionSocket socket_;
+  FakeConnectionSocket socket_;
+  NiceMock<Event::MockDispatcher> dispatcher_;
+  Event::FileReadyCb file_event_callback_;
 };
 
 } // namespace ListenerFilters

test/extensions/filters/listener/common/fuzz/listener_filter_fuzzer.proto

@@ -9,4 +9,5 @@ message Socket {
 
 message FilterFuzzTestCase {
   Socket sock = 1;
+  repeated string data = 2;
 }

test/extensions/filters/listener/http_inspector/BUILD

@@ -1,5 +1,6 @@
 load(
     "//bazel:envoy_build_system.bzl",
+    "envoy_cc_fuzz_test",
     "envoy_package",
 )
 load(
@@ -42,3 +43,13 @@ envoy_extension_cc_test(
         "//test/test_common:threadsafe_singleton_injector_lib",
     ],
 )
+
+envoy_cc_fuzz_test(
+    name = "http_inspector_fuzz_test",
+    srcs = ["http_inspector_fuzz_test.cc"],
+    corpus = "http_inspector_corpus",
+    deps = [
+        "//source/extensions/filters/listener/http_inspector:http_inspector_lib",
+        "//test/extensions/filters/listener/common/fuzz:listener_filter_fuzzer_lib",
+    ],
+)

test/extensions/filters/listener/http_inspector/http_inspector_fuzz_test.cc

@@ -0,0 +1,32 @@
+#include "extensions/filters/listener/http_inspector/http_inspector.h"
+
+#include "test/extensions/filters/listener/common/fuzz/listener_filter_fuzzer.h"
+#include "test/extensions/filters/listener/common/fuzz/listener_filter_fuzzer.pb.validate.h"
+#include "test/fuzz/fuzz_runner.h"
+
+namespace Envoy {
+namespace Extensions {
+namespace ListenerFilters {
+namespace HttpInspector {
+
+DEFINE_PROTO_FUZZER(const test::extensions::filters::listener::FilterFuzzTestCase& input) {
+
+  try {
+    TestUtility::validate(input);
+  } catch (const ProtoValidationException& e) {
+    ENVOY_LOG_MISC(debug, "ProtoValidationException: {}", e.what());
+    return;
+  }
+
+  Stats::IsolatedStoreImpl store;
+  ConfigSharedPtr cfg = std::make_shared<Config>(store);
+  auto filter = std::make_unique<Filter>(cfg);
+
+  ListenerFilterFuzzer fuzzer;
+  fuzzer.fuzz(*filter, input);
+}
+
+} // namespace HttpInspector
+} // namespace ListenerFilters
+} // namespace Extensions
+} // namespace Envoy

test/extensions/filters/listener/original_dst/original_dst_fuzz_test.cc

@@ -19,13 +19,8 @@ DEFINE_PROTO_FUZZER(const test::extensions::filters::listener::FilterFuzzTestCas
   }
 
   auto filter = std::make_unique<OriginalDstFilter>();
-
-  try {
-    ListenerFilterFuzzer fuzzer;
-    fuzzer.fuzz(*filter, input);
-  } catch (const EnvoyException& e) {
-    ENVOY_LOG_MISC(debug, "EnvoyException: {}", e.what());
-  }
+  ListenerFilterFuzzer fuzzer;
+  fuzzer.fuzz(*filter, input);
 }
 
 } // namespace OriginalDst