Add fuzz properties for HTTP/1 and HTTP/2 connections

[ericmj]

Builds on #519, which includes #518. Their commits are included here until they merge, and the HTTP/2 property fails without them. The six fuzz commits are meant to be rebase-merged rather than squashed.

Both properties use StreamData to generate whole connection scenarios. The server's bytes are fed in random chunk sizes through stream/2 (active mode) or recv/3 over the real socket (passive mode), interleaved with client calls.

• test/mint/http1/fuzz_test.exs pipelines one to three requests against random responses. The responses include interim responses, HTTP/1.0, invalid status lines and headers, content-length, chunked with extensions and trailers, close-delimited bodies, and byte mutations.
  • Client calls: streamed request bodies and new requests.
  • Scenarios vary stream_headers, max_header_list_size, case_sensitive_headers, optional_responses and CONNECT requests.
• test/mint/http2/fuzz_test.exs sends random server frames: every frame type, padding, CONTINUATION, valid and invalid header lists, PUSH_PROMISE with valid and invalid stream IDs, and raw bytes.
  • Client calls: cancel, ping, new requests, settings changes and streamed bodies.
  • The server keeps its own view of the connection window.

The properties check that nothing raises and that every response belongs to a known request in the order status, headers, data, trailers, done. They also check the following:

• Nothing follows done or an error.
• A closed or errored connection has no open requests and isn't writable.
• open_request_count/1 and the HTTP/2 stream counters match the unfinished requests.
• A completed body matches its content-length, and HEAD, 204 and 304 responses have no body.
• The HTTP/2 connection window matches what the server sent and received.

FUZZ_RUNS sets the number of scenarios. The defaults are 100 for HTTP/1 (about 0.3 s) and 10 for HTTP/2 (about 3 s).

Run against v1.10.1, every one of 20 seeds × 300 runs fails for both properties. The failure classes are:

• HTTP/1:
  • stream_request_body/3 raising FunctionClauseError;
  • pipelined requests left open after a connection-closing response;
  • :done for a request that had no status yet.
• HTTP/2:
  • DATA before HEADERS;
  • an off-by-one connection window with padded DATA;
  • {:stream_not_found, id} for PUSH_PROMISE on a closed stream;
  • promised refs missing from the ref index;
  • {:done, ref} from RST_STREAM NO_ERROR before any headers.

With the current fixes, both pass 2,000 runs on several seeds.

[coveralls]

Coverage Report for CI Build 4

Coverage increased (+0.2%) to 90.374%

Details

• Coverage increased (+0.2%) from the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	1953
Covered Lines:	1765
Line Coverage:	90.37%
Coverage Strength:	712.82 hits per line

---

💛 - Coveralls