Struct fidl_fuchsia_fuzzer::ControllerProxy

pub struct ControllerProxy { /* private fields */ }

Implementations

impl ControllerProxy

pub fn new(channel: AsyncChannel) -> Self

Create a new Proxy for fuchsia.fuzzer/Controller.

pub fn take_event_stream(&self) -> ControllerEventStream

Get a Stream of events from the remote end of the protocol.

Panics

Panics if the event stream was already taken.

pub fn configure( &self, options: &Options ) -> QueryResponseFut<ControllerConfigureResult>

Sets various execution and error detection parameters. This may be called multiple times; only the most recently received options are used. If the Options parameter omits one or more fields, those parameters are unchanged in the fuzzer. Until the initial call to this method, the fuzzer should assume the default values for Options.

• request options the execution and error detection parameters.

• error one of the following:
• error
  • ZX_ERR_BAD_STATE if a long-running call such as Execute, Cleanse, Minimize, Fuzz, or Merge is in progress.
  • ZX_ERR_NOT_SUPPORTED if a value provided for an option is not supported by the engine. Check the logs for additional details.

pub fn get_options(&self) -> QueryResponseFut<Options>

Gets the current values for the various execution and error detection parameters.

• response options the execution and error detection parameters.

pub fn add_to_corpus( &self, corpus: Corpus, input: Input ) -> QueryResponseFut<ControllerAddToCorpusResult>

Writes the provided input to either the “seed” or “live” corpus. Returns an error if transferring the input fails; see Input for details.

• request corpus the type of corpus to add to.
• request input the sequence of bytes to add as a test input.

• error one of the following:
  • ZX_ERR_INVALID_ARGS if corpus type is invalid.
  • A socket error if transferring the input fails.

pub fn read_corpus( &self, corpus: Corpus, corpus_reader: ClientEnd<CorpusReaderMarker> ) -> QueryResponseFut<()>

Connects a corpus_reader for either the “seed” or “live” corpus.

• request corpus the type of corpus to read from.
• request corpus_reader the client used to send test inputs.

pub fn write_dictionary( &self, dictionary: Input ) -> QueryResponseFut<ControllerWriteDictionaryResult>

Parses and loads an AFL-style dictionary. Invalid entries are logged and skipped.

See also:

• https://github.com/mirrorer/afl/blob/master/dictionaries/README.dictionaries

• request dictionary the AFL-style dictionary

• error one of the following:
  • A socket error if transferring the input fails. *ZX_ERR_INVALID_ARGS if parsing the dictionary fails.

pub fn read_dictionary(&self) -> QueryResponseFut<Input>

Returns the current dictionary as an Input, which may be empty.

• response dictionary the current AFL-style dictionary.

pub fn add_monitor( &self, monitor: ClientEnd<MonitorMarker> ) -> QueryResponseFut<()>

Installs a Monitor to push status. To pull status instead, use GetStatus.

• request monitor the client used to send status updates.

pub fn fuzz(&self) -> QueryResponseFut<ControllerFuzzResult>

Runs the normal fuzzing feedback loop:

1. Selects an input from the corpus.
2. Mutates the input.
3. Uses the TargetAdapter to execute the input.
4. Checks feedback from the InstrumentedProcesses.
5. If the input produced useful feedback, adds it to the corpus.

This call returns quickly, but the loop continues until one of three conditions is met:

1. The configured, non-zero number of runs has been reached.
2. The configured, non-zero duration elapses.
3. An error is detected, and returned.

See Result for more details on long running workflows such as this one.

• error ZX_ERR_BAD_STATE if another long-running workflow is in progress.

pub fn try_one( &self, test_input: Input ) -> QueryResponseFut<ControllerTryOneResult>

Executes the target code with a single test_input.

See Result for more details on long running workflows such as this one.

• request input the sequence of bytes to use with the fuzz target.

• error one of the following:
  • ZX_ERR_BAD_STATE if another long-running workflow is in progress.
  • A socket error if transferring the input fails.

pub fn minimize( &self, test_input: Input ) -> QueryResponseFut<ControllerMinimizeResult>

Attempts to find the smallest input that produces the same error as the given test_input, constrained by the configured total_time and/or runs options.

See Result for more details on long running workflows such as this one.

• request input the sequence of bytes to minimize.

• error one of the following:
  • ZX_ERR_BAD_STATE if another long-running workflow is in progress.
  • A socket error if transferring the input fails.
  • ZX_ERR_INVALID_ARGS if the provided test_input does not cause an error.

pub fn cleanse( &self, test_input: Input ) -> QueryResponseFut<ControllerCleanseResult>

Attempts to replace bytes of the given test_input with “filler” bytes, e.g. \x00, \xFF, without changing the error produced.

See Result for more details on long running workflows such as this one.

To preserve backwards compatibility with libFuzzer and ClusterFuzz, an input that produces no result is not considered an error, and is returned as-is.

• request input the sequence of bytes to cleanse.

• error one of the following:
  • ZX_ERR_BAD_STATE if another long-running workflow is in progress.
  • A socket error if transferring the input fails.

pub fn merge(&self) -> QueryResponseFut<ControllerMergeResult>

Attempts to shrink the corpora. Inputs from the seed corpus will be preserved. All other inputs will be sorted by amount of feedback produced and input size, and only those inputs that add new feedback not seen earlier in the sequence will be kept.

See Result for more details on long running workflows such as this one.

• error one of the following:
  • ZX_ERR_BAD_STATE if another long-running workflow is in progress.
  • ZX_ERR_INVALID_ARGS if an input in the seed corpus causes an error. Inputs in the live corpus that cause errors are skipped.

pub fn get_status(&self) -> QueryResponseFut<Status>

Returns various fuzzing metrics, e.g. total coverage, speed, etc.

• response status the current value of fuzzing metrics.

pub fn watch_artifact(&self) -> QueryResponseFut<Artifact>

Returns the results of a long-running workflow.

This method uses the “hanging get” pattern. Upon the first call for a given connection, it will immediately return the controller’s current artifact. Upon subsequent calls, it will block until the controller’s artifact changes before returning. Clients should use GetStatus to ensure the fuzzer is not idle before making a blocking call to WatchArtifact.

Combined with the Status.running value obtained from GetStatus, this allows a (re-)connecting client to infer the state of the fuzzer:

• If the fuzzer is idle and has an empty artifact, then it is unchanged since the last connection, if any.
• If the fuzzer is running and has an empty artifact, then it is performing a long-running workflow started by a previous connection. The client may call WatchArtifact again to wait for the workflow to complete.
• If the fuzzer is idle and has a non-empty artifact, then it has completed a long-running workflow since the last connection.

It is not an error for clients to disconnect while waiting for a response from this method. This method is intended to allow clients to resume waiting for a long-running workflow to complete after intentionally or inadvertently being disconnected for an indefinite amount of time.

• response artifact the most recent result and/or error-causing input.

Trait Implementations

impl Clone for ControllerProxy

fn clone(&self) -> ControllerProxy

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl ControllerProxyInterface for ControllerProxy

type ConfigureResponseFut = QueryResponseFut<Result<(), i32>>

fn configure(&self, options: &Options) -> Self::ConfigureResponseFut

type GetOptionsResponseFut = QueryResponseFut<Options>

fn get_options(&self) -> Self::GetOptionsResponseFut

type AddToCorpusResponseFut = QueryResponseFut<Result<(), i32>>

fn add_to_corpus( &self, corpus: Corpus, input: Input ) -> Self::AddToCorpusResponseFut

type ReadCorpusResponseFut = QueryResponseFut<()>

fn read_corpus( &self, corpus: Corpus, corpus_reader: ClientEnd<CorpusReaderMarker> ) -> Self::ReadCorpusResponseFut

type WriteDictionaryResponseFut = QueryResponseFut<Result<(), i32>>

fn write_dictionary( &self, dictionary: Input ) -> Self::WriteDictionaryResponseFut

type ReadDictionaryResponseFut = QueryResponseFut<Input>

fn read_dictionary(&self) -> Self::ReadDictionaryResponseFut

type AddMonitorResponseFut = QueryResponseFut<()>

fn add_monitor( &self, monitor: ClientEnd<MonitorMarker> ) -> Self::AddMonitorResponseFut

type FuzzResponseFut = QueryResponseFut<Result<(), i32>>

fn fuzz(&self) -> Self::FuzzResponseFut

type TryOneResponseFut = QueryResponseFut<Result<(), i32>>

fn try_one(&self, test_input: Input) -> Self::TryOneResponseFut

type MinimizeResponseFut = QueryResponseFut<Result<(), i32>>

fn minimize(&self, test_input: Input) -> Self::MinimizeResponseFut

type CleanseResponseFut = QueryResponseFut<Result<(), i32>>

fn cleanse(&self, test_input: Input) -> Self::CleanseResponseFut

type MergeResponseFut = QueryResponseFut<Result<(), i32>>

fn merge(&self) -> Self::MergeResponseFut

type GetStatusResponseFut = QueryResponseFut<Status>

fn get_status(&self) -> Self::GetStatusResponseFut

type WatchArtifactResponseFut = QueryResponseFut<Artifact>

fn watch_artifact(&self) -> Self::WatchArtifactResponseFut

impl Debug for ControllerProxy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Proxy for ControllerProxy

type Protocol = ControllerMarker

The protocol which this Proxy controls.

fn from_channel(inner: AsyncChannel) -> Self

Create a proxy over the given channel.

fn into_channel(self) -> Result<AsyncChannel, Self>

Attempt to convert the proxy back into a channel.

fn as_channel(&self) -> &AsyncChannel

Get a reference to the proxy’s underlying channel.

fn into_client_end(self) -> Result<ClientEnd<Self::Protocol>, Self>

Attempt to convert the proxy back into a client end.

fn is_closed(&self) -> bool

Returns true if the proxy has received the PEER_CLOSED signal.

fn on_closed(&self) -> OnSignals<'_, Unowned<'_, Handle>>

Returns a future that completes when the proxy receives the PEER_CLOSED signal.