Add HTTP/3 fuzzing harness

.github/workflows/ci.yml

@@ -51,6 +51,7 @@ jobs:
  - curl_fuzzer_gopher
  - curl_fuzzer_http
  - curl_fuzzer_https
+ - curl_fuzzer_http3
  - curl_fuzzer_imap
  - curl_fuzzer_ldap
  - curl_fuzzer_mqtt

.gitignore

@@ -40,6 +40,8 @@ missing
 /curl_fuzzer_http_seed_corpus.zip
 /curl_fuzzer_https
 /curl_fuzzer_https_seed_corpus.zip
+/curl_fuzzer_http3
+/curl_fuzzer_http3_seed_corpus.zip
 /curl_fuzzer_imap
 /curl_fuzzer_imap_seed_corpus.zip
 /curl_fuzzer_ldap
@@ -62,3 +64,7 @@ missing
 /curl_fuzzer_smtp_seed_corpus.zip
 /curl_fuzzer_tftp
 /curl_fuzzer_tftp_seed_corpus.zip
+/curl_fuzzer_ws
+/curl_fuzzer_ws_seed_corpus.zip
+/fuzz_url
+/fuzz_url.zip

Makefile.am

@@ -25,7 +25,7 @@ ACLOCAL_AMFLAGS = -I m4
 @CODE_COVERAGE_RULES@
 
 # Include debug symbols by default as recommended by libfuzzer.
-AM_CXXFLAGS = -g -I@INSTALLDIR@/include -I@INSTALLDIR@/utfuzzer
+AM_CXXFLAGS = -g
 
 LIBS = -lpthread -lm
 
@@ -42,6 +42,7 @@ FUZZPROGS = curl_fuzzer \
  curl_fuzzer_gopher \
  curl_fuzzer_http \
  curl_fuzzer_https \
+ curl_fuzzer_http3 \
  curl_fuzzer_imap \
  curl_fuzzer_ldap \
  curl_fuzzer_mqtt \
@@ -59,8 +60,10 @@ FUZZPROGS = curl_fuzzer \
 FUZZLIBS = libstandaloneengine.a
 
 COMMON_SOURCES = curl_fuzzer.cc curl_fuzzer_tlv.cc curl_fuzzer_callback.cc
-COMMON_FLAGS = $(AM_CXXFLAGS) $(CODE_COVERAGE_CXXFLAGS)
-COMMON_LDADD = @INSTALLDIR@/lib/libcurl.la $(LIB_FUZZING_ENGINE) $(CODE_COVERAGE_LIBS)
+COMMON_FLAGS = -I@INSTALLDIR@/openssl/include -I@INSTALLDIR@/openssl/utfuzzer $(AM_CXXFLAGS) $(CODE_COVERAGE_CXXFLAGS)
+COMMON_LDADD = @INSTALLDIR@/openssl/lib/libcurl.la $(LIB_FUZZING_ENGINE) $(CODE_COVERAGE_LIBS)
+HTTP3_FLAGS = -I@INSTALLDIR@/openssl_quic/include -I@INSTALLDIR@/openssl_quic/utfuzzer $(AM_CXXFLAGS) $(CODE_COVERAGE_CXXFLAGS)
+HTTP3_LDADD = @INSTALLDIR@/openssl_quic/lib/libcurl.la $(LIB_FUZZING_ENGINE) $(CODE_COVERAGE_LIBS)
 
 libstandaloneengine_a_SOURCES = standalone_fuzz_target_runner.cc
 libstandaloneengine_a_CXXFLAGS = $(AM_CXXFLAGS)
@@ -89,6 +92,9 @@ curl_fuzzer_http_LDADD = $(COMMON_LDADD)
 curl_fuzzer_https_SOURCES = $(COMMON_SOURCES)
 curl_fuzzer_https_CXXFLAGS = $(COMMON_FLAGS) -DFUZZ_PROTOCOLS_HTTPS
 curl_fuzzer_https_LDADD = $(COMMON_LDADD)
+curl_fuzzer_http3_SOURCES = $(COMMON_SOURCES)
+curl_fuzzer_http3_CXXFLAGS = $(HTTP3_FLAGS) -DFUZZ_PROTOCOLS_HTTP3 -DFUZZ_PROTOCOLS_HTTPS
+curl_fuzzer_http3_LDADD = $(HTTP3_LDADD)
 curl_fuzzer_imap_SOURCES = $(COMMON_SOURCES)
 curl_fuzzer_imap_CXXFLAGS = $(COMMON_FLAGS) -DFUZZ_PROTOCOLS_IMAP
 curl_fuzzer_imap_LDADD = $(COMMON_LDADD)

curl_fuzzer.cc

@@ -207,8 +207,10 @@ int fuzz_set_easy_options(FUZZ_DATA *fuzz)
  /* Set the hsts header cache filepath so that it can be fuzzed. */
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_HSTS, FUZZ_HSTS_HEADER_CACHE_PATH));
 
+#ifndef FUZZ_PROTOCOLS_HTTPS
  /* Set the Certificate Revocation List file path so it can be fuzzed */
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_CRLFILE, FUZZ_CRL_FILE_PATH));
+#endif
 
  /* Set the .netrc file path so it can be fuzzed */
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_NETRC_FILE, FUZZ_NETRC_FILE_PATH));
@@ -571,6 +573,16 @@ int fuzz_set_allowed_protocols(FUZZ_DATA *fuzz)
 
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_PROTOCOLS_STR, allowed_protocols));
 
+ #ifdef FUZZ_PROTOCOLS_HTTP3
+ /* If we are fuzzing HTTP3, then we must be fuzzing the HTTPS protocol */
+ #ifndef FUZZ_PROTOCOLS_HTTPS
+ rc = 255;
+ goto EXIT_LABEL;
+ #endif
+
+ FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_3ONLY));
+ #endif 
+
 EXIT_LABEL:
 
  return rc;

curl_fuzzer_callback.cc

@@ -69,7 +69,14 @@ curl_socket_t fuzz_open_socket(void *ptr,
  sman->index,
  sman->index);
 
- if(socketpair(AF_UNIX, SOCK_STREAM, 0, fds)) {
+
+ #ifdef FUZZ_PROTOCOLS_HTTP3
+ const int socket_type = SOCK_DGRAM;
+ #else
+ const int socket_type = SOCK_STREAM;
+ #endif
+
+ if(socketpair(AF_UNIX, socket_type, 0, fds)) {
  /* Failed to create a pair of sockets. */
  return CURL_SOCKET_BAD;
  }

mainline.sh

@@ -8,21 +8,25 @@ SCRIPTDIR=${BUILD_ROOT}/scripts
 
 CURLDIR=/tmp/curl
 OPENSSLDIR=/tmp/openssl
-NGHTTPDIR=/tmp/nghttp2
-INSTALLDIR=/tmp/curl_install
+NGHTTP2DIR=/tmp/nghttp2
+NGHTTP3DIR=/tmp/nghttp3
+NGTCP2DIR=/tmp/ngtcp2
+INSTALLDIRTOP=/tmp/curl_install
 
 # Parse the options.
 OPTIND=1
 
-while getopts "c:n:o:" opt
+while getopts "c:n:o:t:" opt
 do
  case "$opt" in
  c) CURLDIR=$OPTARG
  ;;
- n) NGHTTPDIR=$OPTARG
+ n) NGHTTP2DIR=$OPTARG
  ;;
  o) OPENSSLDIR=$OPTARG
  ;;
+ t) NGTCP2DIR=$OPTARG
+ ;;
  esac
 done
 shift $((OPTIND-1))
@@ -34,16 +38,29 @@ FUZZ_FLAG="-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION"
 export CFLAGS="-fsanitize=address"
 export CXXFLAGS="-fsanitize=address -stdlib=libstdc++ $FUZZ_FLAG"
 export CPPFLAGS="$FUZZ_FLAG"
-export OPENSSLFLAGS="-fno-sanitize=alignment"
+export OPENSSLFLAGS="-fno-sanitize=alignment -lstdc++"
+
+for tls_lib in openssl openssl_quic; do
+ INSTALLDIR="$INSTALLDIRTOP/$tls_lib"
+ mkdir -p "$INSTALLDIR"
+
+ # Install tls_lib
+ ${SCRIPTDIR}/handle_x.sh ${tls_lib} ${OPENSSLDIR}/${tls_lib} ${INSTALLDIR} || exit 1
 
-# Install openssl
-${SCRIPTDIR}/handle_x.sh openssl ${OPENSSLDIR} ${INSTALLDIR} || exit 1
+ # Install nghttp2
+ ${SCRIPTDIR}/handle_x.sh nghttp2 ${NGHTTP2DIR} ${INSTALLDIR} || exit 1
 
-# Install nghttp2
-${SCRIPTDIR}/handle_x.sh nghttp2 ${NGHTTPDIR} ${INSTALLDIR} || exit 1
+ if [[ "$tls_lib" == "openssl_quic" ]]; then
+ # Install nghttp3
+ ${SCRIPTDIR}/handle_x.sh nghttp3 ${NGHTTP3DIR} ${INSTALLDIR} || exit 1
 
-# Install curl after all other dependencies
-${SCRIPTDIR}/handle_x.sh curl ${CURLDIR} ${INSTALLDIR} || exit 1
+ # Install ngtcp2
+ ${SCRIPTDIR}/handle_x.sh ngtcp2 ${NGTCP2DIR} ${INSTALLDIR} || exit 1
+ fi
+
+ # Install curl after all other dependencies
+ ${SCRIPTDIR}/handle_x.sh curl ${CURLDIR} ${INSTALLDIR} || exit 1
+done
 
 # Compile and test the fuzzers.
-${SCRIPTDIR}/compile_fuzzer.sh ${INSTALLDIR} || exit 1
+${SCRIPTDIR}/compile_fuzzer.sh ${INSTALLDIRTOP} || exit 1

ossfuzz.sh

@@ -29,7 +29,9 @@ SCRIPTDIR=${BUILD_ROOT}/scripts
 
 ZLIBDIR=/src/zlib
 OPENSSLDIR=/src/openssl
-NGHTTPDIR=/src/nghttp2
+NGHTTP2DIR=/src/nghttp2
+NGHTTP3DIR=/src/nghttp3
+NGTCP2DIR=/src/ngtcp2
 GDBDIR=/src/gdb
 
 # Check for GDB-specific behaviour by checking for the GDBMODE flag.
@@ -53,7 +55,7 @@ echo "FUZZ_TARGETS: $FUZZ_TARGETS"
 export MAKEFLAGS+="-j$(nproc)"
 
 # Make an install directory
-export INSTALLDIR=/src/curl_install
+export INSTALLDIRTOP=/src/curl_install
 
 # Check for GDB-specific behaviour by checking for the GDBMODE flag.
 # - Compile and installing GDB if necessary.
@@ -67,26 +69,40 @@ then
  fi
 fi
 
-# Install zlib
-${SCRIPTDIR}/handle_x.sh zlib ${ZLIBDIR} ${INSTALLDIR} || exit 1
+for tls_lib in openssl openssl_quic; do
+ INSTALLDIR="$INSTALLDIRTOP/$tls_lib"
+ mkdir -p "$INSTALLDIR"
 
-# For the memory sanitizer build, turn off OpenSSL as it causes bugs we can't
-# affect (see 16697, 17624)
-if [[ ${SANITIZER} != "memory" ]]
-then
- # Install openssl
- export OPENSSLFLAGS="-fno-sanitize=alignment"
- ${SCRIPTDIR}/handle_x.sh openssl ${OPENSSLDIR} ${INSTALLDIR} || exit 1
-fi
+ # Install zlib
+ ${SCRIPTDIR}/handle_x.sh zlib ${ZLIBDIR} ${INSTALLDIR} || exit 1
+
+ # For the memory sanitizer build, turn off OpenSSL as it causes bugs we can't
+ # affect (see 16697, 17624)
+ if [[ ${SANITIZER} != "memory" ]]
+ then
+ # Install openssl_quic (need openssl_quic, nghttp3, and ngtcp2 for HTTP3 support)
+ export OPENSSLFLAGS="-fno-sanitize=alignment"
+ ${SCRIPTDIR}/handle_x.sh ${tls_lib} ${OPENSSLDIR}/${tls_lib} ${INSTALLDIR} || exit 1
 
-# Install nghttp2
-${SCRIPTDIR}/handle_x.sh nghttp2 ${NGHTTPDIR} ${INSTALLDIR} || exit 1
+ if [[ "$tls_lib" == "openssl_quic" ]]
+ then
+ # Install nghttp3
+ ${SCRIPTDIR}/handle_x.sh nghttp3 ${NGHTTP3DIR} ${INSTALLDIR} || exit 1
 
-# Compile curl
-${SCRIPTDIR}/install_curl.sh /src/curl ${INSTALLDIR}
+ # Install ngtcp2
+ ${SCRIPTDIR}/handle_x.sh ngtcp2 ${NGTCP2DIR} ${INSTALLDIR} || exit 1
+ fi
+ fi
+
+ # Install nghttp2
+ ${SCRIPTDIR}/handle_x.sh nghttp2 ${NGHTTP2DIR} ${INSTALLDIR} || exit 1
+
+ # Compile curl
+ ${SCRIPTDIR}/install_curl.sh /src/curl ${INSTALLDIR}
+done
 
 # Build the fuzzers.
-${SCRIPTDIR}/compile_fuzzer.sh ${INSTALLDIR}
+${SCRIPTDIR}/compile_fuzzer.sh ${INSTALLDIRTOP}
 make zip
 
 # Copy the fuzzers over.

renovate.json

@@ -23,6 +23,17 @@
  "depNameTemplate": "openssl/openssl",
  "versioningTemplate": "regex:^openssl-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
  "registryUrlTemplate": "https://github.com"
+ },
+ {
+ "customType": "regex",
+ "fileMatch": ["^scripts/VERSIONS$"],
+ "matchStrings": [
+ "QUICTLS_VERSION=(?<currentValue>.*)\\s"
+ ],
+ "datasourceTemplate": "github-tags",
+ "depNameTemplate": "openssl/openssl",
+ "versioningTemplate": "regex:^openssl-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-quic\\d+$",
+ "registryUrlTemplate": "https://github.com"
  }
  ],
  "packageRules": [

scripts/VERSIONS

@@ -3,5 +3,14 @@
 # Handled by renovate.json
 OPENSSL_VERSION=openssl-3.2.0
 
+# Handled by renovate.json
+QUICTLS_VERSION=openssl-3.1.4-quic1
+
 # renovate: datasource=github-tags depName=nghttp2/nghttp2 versioning=semver registryUrl=https://github.com
 NGHTTP2_VERSION=v1.58.0
+
+# renovate: datasource=github-tags depName=ngtcp2/nghttp3 versioning=semver registryUrl=https://github.com
+NGHTTP3_VERSION=v1.1.0
+
+# renovate: datasource=github-tags depName=ngtcp2/ngtcp2 versioning=semver registryUrl=https://github.com
+NGTCP2_VERSION=v1.1.0

scripts/download_curl.sh

@@ -6,3 +6,21 @@ set -ex
 # Clone the curl repository to the specified directory.
 git clone http://github.com/curl/curl $1
 
+# TODO: Ignore HTTP3 socket connection failures
+pushd $1
+patch -p1 <<'EOF'
+diff --git a/lib/cf-socket.c b/lib/cf-socket.c
+index e42b4a87b..f99fcd80c 100644
+--- a/lib/cf-socket.c
++++ b/lib/cf-socket.c
+@@ -1650,7 +1650,7 @@ static CURLcode cf_udp_setup_quic(struct Curl_cfilter *cf,
+
+ rc = connect(ctx->sock, &ctx->addr.sa_addr, ctx->addr.addrlen);
+ if(-1 == rc) {
+- return socket_connect_result(data, ctx->r_ip, SOCKERRNO);
++ /* return socket_connect_result(data, ctx->r_ip, SOCKERRNO); */
+ }
+ set_local_ip(cf, data);
+ CURL_TRC_CF(data, cf, "%s socket %" CURL_FORMAT_SOCKET_T
+EOF
+popd

scripts/download_nghttp3.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+
+# If any commands fail, fail the script immediately.
+set -ex
+
+# Get the script directory and source the VERSIONS file
+SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+source $SCRIPT_DIR/VERSIONS
+
+# Clone the repository to the specified directory.
+git clone --depth 1 --branch ${NGHTTP3_VERSION} https://github.com/ngtcp2/nghttp3 $1