Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fuzzing: Add 3 fuzzers for mysql endpoints #7639

Merged
merged 1 commit into from
Mar 9, 2021
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
218 changes: 218 additions & 0 deletions go/mysql/mysql_fuzzer.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,218 @@
/*
Copyright 2021 The Vitess Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
// +build gofuzz

package mysql

import (
"fmt"
"net"
"sync"
"time"

"vitess.io/vitess/go/sqltypes"
querypb "vitess.io/vitess/go/vt/proto/query"
)

func createFuzzingSocketPair() (net.Listener, *Conn, *Conn) {
// Create a listener.
listener, err := net.Listen("tcp", ":0")
if err != nil {
fmt.Println("We got an error early on")
return nil, nil, nil
}
addr := listener.Addr().String()
listener.(*net.TCPListener).SetDeadline(time.Now().Add(10 * time.Second))

// Dial a client, Accept a server.
wg := sync.WaitGroup{}

var clientConn net.Conn
var clientErr error
wg.Add(1)
go func() {
defer wg.Done()
clientConn, clientErr = net.DialTimeout("tcp", addr, 10*time.Second)
}()

var serverConn net.Conn
var serverErr error
wg.Add(1)
go func() {
defer wg.Done()
serverConn, serverErr = listener.Accept()
}()

wg.Wait()

if clientErr != nil {
return nil, nil, nil
}
if serverErr != nil {
return nil, nil, nil
}

// Create a Conn on both sides.
cConn := newConn(clientConn)
sConn := newConn(serverConn)

return listener, sConn, cConn
}

type fuzztestRun struct{}

func (t fuzztestRun) NewConnection(c *Conn) {
panic("implement me")
}

func (t fuzztestRun) ConnectionClosed(c *Conn) {
panic("implement me")
}

func (t fuzztestRun) ComQuery(c *Conn, query string, callback func(*sqltypes.Result) error) error {
return nil
}

func (t fuzztestRun) ComPrepare(c *Conn, query string, bindVars map[string]*querypb.BindVariable) ([]*querypb.Field, error) {
panic("implement me")
}

func (t fuzztestRun) ComStmtExecute(c *Conn, prepare *PrepareData, callback func(*sqltypes.Result) error) error {
panic("implement me")
}

func (t fuzztestRun) WarningCount(c *Conn) uint16 {
return 0
}

func (t fuzztestRun) ComResetConnection(c *Conn) {
panic("implement me")
}

var _ Handler = (*fuzztestRun)(nil)

type fuzztestConn struct {
writeToPass []bool
pos int
queryPacket []byte
}

func (t fuzztestConn) Read(b []byte) (n int, err error) {
for j, i := range t.queryPacket {
b[j] = i
}
return len(b), nil
}

func (t fuzztestConn) Write(b []byte) (n int, err error) {
t.pos = t.pos + 1
if t.writeToPass[t.pos] {
return 0, nil
}
return 0, fmt.Errorf("error in writing to connection")
}

func (t fuzztestConn) Close() error {
panic("implement me")
}

func (t fuzztestConn) LocalAddr() net.Addr {
panic("implement me")
}

func (t fuzztestConn) RemoteAddr() net.Addr {
return fuzzmockAddress{s: "a"}
}

func (t fuzztestConn) SetDeadline(t1 time.Time) error {
panic("implement me")
}

func (t fuzztestConn) SetReadDeadline(t1 time.Time) error {
panic("implement me")
}

func (t fuzztestConn) SetWriteDeadline(t1 time.Time) error {
panic("implement me")
}

var _ net.Conn = (*fuzztestConn)(nil)

type fuzzmockAddress struct {
s string
}

func (m fuzzmockAddress) Network() string {
return m.s
}

func (m fuzzmockAddress) String() string {
return m.s
}

var _ net.Addr = (*fuzzmockAddress)(nil)

// Fuzzers begin here:
func FuzzWritePacket(data []byte) int {
listener, sConn, cConn := createFuzzingSocketPair()
defer func() {
listener.Close()
sConn.Close()
cConn.Close()
}()

err := cConn.writePacket(data)
if err != nil {
return 0
}
_, err = sConn.ReadPacket()
if err != nil {
return 0
}
return 1
}

func FuzzHandleNextCommand(data []byte) int {
sConn := newConn(fuzztestConn{
writeToPass: []bool{false},
pos: -1,
queryPacket: data,
})

handler := &fuzztestRun{}
_ = sConn.handleNextCommand(handler)
return 1
}

func FuzzReadQueryResults(data []byte) int {
listener, sConn, cConn := createFuzzingSocketPair()
defer func() {
listener.Close()
sConn.Close()
cConn.Close()
}()
err := cConn.WriteComQuery(string(data))
if err != nil {
return 0
}
handler := &fuzztestRun{}
_ = sConn.handleNextCommand(handler)
_, _, _, err = cConn.ReadQueryResult(100, true)
if err != nil {
return 0
}
return 1
}
4 changes: 4 additions & 0 deletions go/test/fuzzing/oss_fuzz_build.sh
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,10 @@ compile_go_fuzzer ./go/test/fuzzing FuzzIsDML is_dml_fuzzer
compile_go_fuzzer ./go/test/fuzzing FuzzNormalizer normalizer_fuzzer
compile_go_fuzzer ./go/test/fuzzing FuzzParser parser_fuzzer

#cp ./go/test/fuzzing/mysql/mysql_fuzzer.go ./go/mysql/
compile_go_fuzzer ./go/mysql FuzzWritePacket write_packet_fuzzer
compile_go_fuzzer ./go/mysql FuzzHandleNextCommand handle_next_command_fuzzer
compile_go_fuzzer ./go/mysql FuzzReadQueryResults read_query_results_fuzzer

# Build dictionaries
cp $SRC/vitess/go/test/fuzzing/vtctl_fuzzer.dict $OUT/