Add Fuzzing tests for DNS resolver

Directory.Packages.props

@@ -164,6 +164,8 @@
     <PackageVersion Include="Testcontainers.Oracle" Version="$(TestcontainersPackageVersion)" />
     <PackageVersion Include="Testcontainers.Elasticsearch" Version="$(TestcontainersPackageVersion)" />
     <PackageVersion Include="Testcontainers" Version="$(TestcontainersPackageVersion)" />
+    <!-- Fuzzing tests dependencies -->
+    <PackageVersion Include="SharpFuzz" Version="$(SharpFuzzPackageVersion)" />
     <!-- playground apps dependencies -->
     <PackageVersion Include="Dapr.AspNetCore" Version="1.14.0" />
     <PackageVersion Include="Microsoft.Orleans.Clustering.AzureStorage" Version="8.2.0" />

eng/Versions.props

@@ -67,6 +67,8 @@
     <!-- System dependencies -->
     <SystemFormatsAsn1PackageVersion>8.0.1</SystemFormatsAsn1PackageVersion>
     <SystemTextJsonPackageVersion>8.0.5</SystemTextJsonPackageVersion>
+    <!-- Fuzzing tests -->
+    <SharpFuzzPackageVersion>2.2.0</SharpFuzzPackageVersion>
   </PropertyGroup>
   <PropertyGroup Condition="'$(TargetFramework)' == 'net9.0'">
     <!-- Runtime -->

src/Microsoft.Extensions.ServiceDiscovery.Dns/Microsoft.Extensions.ServiceDiscovery.Dns.csproj

@@ -27,6 +27,7 @@
 
   <ItemGroup>
     <InternalsVisibleTo Include="Microsoft.Extensions.ServiceDiscovery.Dns.Tests" />
+    <InternalsVisibleTo Include="Microsoft.Extensions.ServiceDiscovery.Dns.Tests.Fuzzing" />
     <InternalsVisibleTo Include="Microsoft.Extensions.ServiceDiscovery.Yarp.Tests" />
   </ItemGroup>
 

src/Microsoft.Extensions.ServiceDiscovery.Dns/Resolver/DnsResolver.cs

@@ -33,7 +33,11 @@ internal void SetTimeProvider(TimeProvider timeProvider)
         _timeProvider = timeProvider;
     }
 
-    public DnsResolver(TimeProvider timeProvider, ILogger<DnsResolver> logger) : this(OperatingSystem.IsLinux() || OperatingSystem.IsMacOS() ? ResolvConf.GetOptions() : NetworkInfo.GetOptions())
+    public DnsResolver(TimeProvider timeProvider, ILogger<DnsResolver> logger) : this(timeProvider, logger, OperatingSystem.IsLinux() || OperatingSystem.IsMacOS() ? ResolvConf.GetOptions() : NetworkInfo.GetOptions())
+    {
+    }
+
+    public DnsResolver(TimeProvider timeProvider, ILogger<DnsResolver> logger, ResolverOptions options) : this(options)
     {
         _timeProvider = timeProvider;
         _logger = logger;
@@ -407,8 +411,9 @@ internal struct SendQueryResult
                     }
                     catch (Exception ex) when (!cancellationToken.IsCancellationRequested)
                     {
+                        // internal error, propagate
                         Log.QueryError(_logger, queryType, name, serverEndPoint, attempt, ex);
-                        lastError = SendQueryError.InternalError;
+                        throw;
                     }
 
                     switch (lastError)
@@ -515,16 +520,27 @@ private async ValueTask<SendQueryResult> SendQueryToServerAsync(IPEndPoint serve
 
         SendQueryError sendError = SendQueryError.NoError;
         DateTime queryStartedTime = _timeProvider.GetUtcNow().DateTime;
-        (DnsDataReader responseReader, DnsMessageHeader header) = await SendDnsQueryCoreUdpAsync(serverEndPoint, dnsSafeName, queryType, cancellationToken).ConfigureAwait(false);
+        DnsDataReader responseReader = default;
+        DnsMessageHeader header;
 
         try
         {
-            if (header.IsResultTruncated)
+            // use transport override if provided
+            if (_options._transportOverride != null)
             {
-                Log.ResultTruncated(_logger, queryType, name, serverEndPoint, 0);
-                responseReader.Dispose();
-                // TCP fallback
-                (responseReader, header, sendError) = await SendDnsQueryCoreTcpAsync(serverEndPoint, dnsSafeName, queryType, cancellationToken).ConfigureAwait(false);
+                (responseReader, header, sendError) = SendDnsQueryCustomTransport(_options._transportOverride, dnsSafeName, queryType);
+            }
+            else
+            {
+                (responseReader, header) = await SendDnsQueryCoreUdpAsync(serverEndPoint, dnsSafeName, queryType, cancellationToken).ConfigureAwait(false);
+
+                if (header.IsResultTruncated)
+                {
+                    Log.ResultTruncated(_logger, queryType, name, serverEndPoint, 0);
+                    responseReader.Dispose();
+                    // TCP fallback
+                    (responseReader, header, sendError) = await SendDnsQueryCoreTcpAsync(serverEndPoint, dnsSafeName, queryType, cancellationToken).ConfigureAwait(false);
+                }
             }
 
             if (sendError != SendQueryError.NoError)
@@ -688,6 +704,36 @@ internal static SendQueryError ValidateResponse(QueryResponseCode responseCode,
         return SendQueryError.ServerError;
     }
 
+    internal static (DnsDataReader reader, DnsMessageHeader header, SendQueryError sendError) SendDnsQueryCustomTransport(Func<Memory<byte>, int, int> callback, EncodedDomainName dnsSafeName, QueryType queryType)
+    {
+        byte[] buffer = ArrayPool<byte>.Shared.Rent(2048);
+        try
+        {
+            (ushort transactionId, int length) = EncodeQuestion(buffer, dnsSafeName, queryType);
+            length = callback(buffer, length);
+
+            DnsDataReader responseReader = new DnsDataReader(new ArraySegment<byte>(buffer, 0, length), true);
+
+            if (!responseReader.TryReadHeader(out DnsMessageHeader header) ||
+                header.TransactionId != transactionId ||
+                !header.IsResponse)
+            {
+                return (default, default, SendQueryError.MalformedResponse);
+            }
+
+            // transfer ownership of buffer to the caller
+            buffer = null!;
+            return (responseReader, header, SendQueryError.NoError);
+        }
+        finally
+        {
+            if (buffer != null)
+            {
+                ArrayPool<byte>.Shared.Return(buffer);
+            }
+        }
+    }
+
     internal static async ValueTask<(DnsDataReader reader, DnsMessageHeader header)> SendDnsQueryCoreUdpAsync(IPEndPoint serverEndPoint, EncodedDomainName dnsSafeName, QueryType queryType, CancellationToken cancellationToken)
     {
         var buffer = ArrayPool<byte>.Shared.Rent(512);

src/Microsoft.Extensions.ServiceDiscovery.Dns/Resolver/ResolverOptions.cs

@@ -11,6 +11,9 @@ internal sealed class ResolverOptions
     public int Attempts = 2;
     public TimeSpan Timeout = TimeSpan.FromSeconds(3);
 
+    // override for testing purposes
+    internal Func<Memory<byte>, int, int>? _transportOverride;
+
     public ResolverOptions(IReadOnlyList<IPEndPoint> servers)
     {
         if (servers.Count == 0)

tests/Microsoft.Extensions.ServiceDiscovery.Dns.Tests.Fuzzing/.gitignore

@@ -0,0 +1,2 @@
+# corpuses generated by the fuzzing engine
+corpuses/**

tests/Microsoft.Extensions.ServiceDiscovery.Dns.Tests.Fuzzing/Fuzzers/DnsResponseFuzzer.cs

@@ -0,0 +1,44 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System.Diagnostics;
+using System.Net;
+using System.Net.Sockets;
+
+namespace Microsoft.Extensions.ServiceDiscovery.Dns.Tests.Fuzzing;
+
+internal sealed class DnsResponseFuzzer : IFuzzer
+{
+    DnsResolver? _resolver;
+    byte[]? _buffer;
+    int _length;
+
+    public void FuzzTarget(ReadOnlySpan<byte> data)
+    {
+        // lazy init
+        if (_resolver == null)
+        {
+            _buffer = new byte[4096];
+            _resolver = new DnsResolver(new ResolverOptions(new IPEndPoint(IPAddress.Loopback, 53))
+            {
+                Timeout = TimeSpan.FromSeconds(5),
+                Attempts = 1,
+                _transportOverride = (buffer, length) =>
+                {
+                    // the first two bytes are the random transaction ID, so we keep that
+                    // and use the fuzzing payload for the rest of the DNS response
+                    _buffer.AsSpan(0, Math.Min(_length, buffer.Length - 2)).CopyTo(buffer.Span.Slice(2));
+                    return _length + 2;
+                }
+            });
+        }
+
+        data.CopyTo(_buffer!);
+        _length = data.Length;
+
+        // the _transportOverride makes the execution synchronous
+        ValueTask<AddressResult[]> task = _resolver!.ResolveIPAddressesAsync("www.example.com", AddressFamily.InterNetwork, CancellationToken.None);
+        Debug.Assert(task.IsCompleted, "Task should be completed synchronously");
+        task.GetAwaiter().GetResult();
+    }
+}

tests/Microsoft.Extensions.ServiceDiscovery.Dns.Tests.Fuzzing/Fuzzers/EncodedDomainNameFuzzer.cs

@@ -0,0 +1,38 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+namespace Microsoft.Extensions.ServiceDiscovery.Dns.Tests.Fuzzing;
+
+internal sealed class EncodedDomainNameFuzzer : IFuzzer
+{
+    public void FuzzTarget(ReadOnlySpan<byte> data)
+    {
+        // first byte is the offset of the domain name, rest is the actual
+        // (simulated) DNS message payload
+
+        if (data.Length < 1)
+        {
+            return;
+        }
+
+        byte[] buffer = ArrayPool<byte>.Shared.Rent(data.Length);
+        try
+        {
+            int offset = data[0];
+            data.Slice(1).CopyTo(buffer);
+
+            if (!DnsPrimitives.TryReadQName(buffer.AsMemory(0, data.Length - 1), offset, out EncodedDomainName name, out _))
+            {
+                return;
+            }
+
+            // the domain name should be readable
+            _ = name.ToString();
+        }
+        finally
+        {
+            ArrayPool<byte>.Shared.Return(buffer);
+        }
+
+    }
+}

tests/Microsoft.Extensions.ServiceDiscovery.Dns.Tests.Fuzzing/Fuzzers/WriteDomainNameRoundTripFuzzer.cs

@@ -0,0 +1,48 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System.Text;
+
+namespace Microsoft.Extensions.ServiceDiscovery.Dns.Tests.Fuzzing;
+
+internal sealed class WriteDomainNameRoundTripFuzzer : IFuzzer
+{
+    private static readonly System.Globalization.IdnMapping s_idnMapping = new();
+    public void FuzzTarget(ReadOnlySpan<byte> data)
+    {
+        // first byte is the offset of the domain name, rest is the actual
+        // (simulated) DNS message payload
+
+        byte[] buffer = ArrayPool<byte>.Shared.Rent(data.Length * 2);
+
+        try
+        {
+            string domainName = Encoding.UTF8.GetString(data);
+            if (!DnsPrimitives.TryWriteQName(buffer, domainName, out int written))
+            {
+                return;
+            }
+
+            if (!DnsPrimitives.TryReadQName(buffer.AsMemory(0, written), 0, out EncodedDomainName name, out int read))
+            {
+                return;
+            }
+
+            if (read != written)
+            {
+                throw new InvalidOperationException($"Read {read} bytes, but wrote {written} bytes");
+            }
+
+            string readName = name.ToString();
+
+            if (!string.Equals(s_idnMapping.GetAscii(domainName).TrimEnd('.'), readName, StringComparison.OrdinalIgnoreCase))
+            {
+                throw new InvalidOperationException($"Domain name mismatch: {readName} != {domainName}");
+            }
+        }
+        finally
+        {
+            ArrayPool<byte>.Shared.Return(buffer);
+        }
+    }
+}

tests/Microsoft.Extensions.ServiceDiscovery.Dns.Tests.Fuzzing/GlobalUsings.cs

@@ -0,0 +1,5 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+global using System.Buffers;
+global using Microsoft.Extensions.ServiceDiscovery.Dns.Resolver;

tests/Microsoft.Extensions.ServiceDiscovery.Dns.Tests.Fuzzing/IFuzzer.cs

@@ -0,0 +1,10 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+namespace Microsoft.Extensions.ServiceDiscovery.Dns.Tests.Fuzzing;
+
+public interface IFuzzer
+{
+    string Name => GetType().Name;
+    void FuzzTarget(ReadOnlySpan<byte> data);
+}

tests/Microsoft.Extensions.ServiceDiscovery.Dns.Tests.Fuzzing/Microsoft.Extensions.ServiceDiscovery.Dns.Tests.Fuzzing.csproj

@@ -0,0 +1,18 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>$(DefaultTargetFramework)</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <OutputType>Exe</OutputType>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="SharpFuzz" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\..\src\Microsoft.Extensions.ServiceDiscovery.Dns\Microsoft.Extensions.ServiceDiscovery.Dns.csproj" />
+  </ItemGroup>
+
+</Project>

tests/Microsoft.Extensions.ServiceDiscovery.Dns.Tests.Fuzzing/Program.cs

@@ -0,0 +1,64 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using SharpFuzz;
+
+namespace Microsoft.Extensions.ServiceDiscovery.Dns.Tests.Fuzzing;
+
+public static class Program
+{
+    public static void Main(string[] args)
+    {
+        IFuzzer[] fuzzers = typeof(Program).Assembly.GetTypes()
+            .Where(t => t.IsClass && !t.IsAbstract)
+            .Where(t => t.GetInterfaces().Contains(typeof(IFuzzer)))
+            .Select(t => (IFuzzer)Activator.CreateInstance(t)!)
+            .OrderBy(f => f.Name, StringComparer.OrdinalIgnoreCase)
+            .ToArray();
+
+        void PrintUsage()
+        {
+            Console.Error.WriteLine($"""
+            Usage:
+                DotnetFuzzing list
+                DotnetFuzzing <Fuzzer name> [input file/directory]
+                // DotnetFuzzing prepare-onefuzz <output directory>
+
+            Available fuzzers:
+            {string.Join(Environment.NewLine, fuzzers.Select(f => $"    {f.Name}"))}
+            """);
+        }
+
+        if (args.Length == 0)
+        {
+            PrintUsage();
+            return;
+        }
+
+        string arg = args[0];
+        IFuzzer? fuzzer = fuzzers.FirstOrDefault(f => string.Equals(f.Name, arg, StringComparison.OrdinalIgnoreCase));
+        if (fuzzer == null)
+        {
+            Console.Error.WriteLine($"Unknown fuzzer: {arg}");
+            PrintUsage();
+            return;
+        }
+
+        string? inputFiles = args.Length > 1 ? args[1] : null;
+        if (string.IsNullOrEmpty(inputFiles))
+        {
+            // no input files, let the fuzzer generate
+            Fuzzer.LibFuzzer.Run(fuzzer.FuzzTarget);
+            return;
+        }
+
+        string[] files = Directory.Exists(inputFiles)
+            ? Directory.GetFiles(inputFiles)
+            : [inputFiles];
+
+        foreach (string inputFile in files)
+        {
+            fuzzer.FuzzTarget(File.ReadAllBytes(inputFile));
+        }
+    }
+}

tests/Microsoft.Extensions.ServiceDiscovery.Dns.Tests.Fuzzing/corpus-seed/WriteDomainNameRoundTripFuzzer/example

@@ -0,0 +1 @@
+www.example.com

tests/Microsoft.Extensions.ServiceDiscovery.Dns.Tests.Fuzzing/corpus-seed/WriteDomainNameRoundTripFuzzer/nonascii

@@ -0,0 +1 @@
+www.řffwefw.com

tests/Microsoft.Extensions.ServiceDiscovery.Dns.Tests.Fuzzing/corpus-seed/WriteDomainNameRoundTripFuzzer/toolong

@@ -0,0 +1 @@
+aa.efaw.ef.wef.ef.wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww.fafeww.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.fwefefefefwefwf.wzzefwefwefwefwfeewfwefwefw.ffff