pub struct ControllerProxy { /* private fields */ }

Implementations§

source§

impl ControllerProxy

source

pub fn new(channel: AsyncChannel) -> Self

Create a new Proxy for fuchsia.fuzzer/Controller.

source

pub fn take_event_stream(&self) -> ControllerEventStream

Get a Stream of events from the remote end of the protocol.

§Panics

Panics if the event stream was already taken.

source

pub fn configure( &self, options: &Options ) -> QueryResponseFut<ControllerConfigureResult>

Sets various execution and error detection parameters. This may be called multiple times; only the most recently received options are used. If the Options parameter omits one or more fields, those parameters are unchanged in the fuzzer. Until the initial call to this method, the fuzzer should assume the default values for Options.

  • request options the execution and error detection parameters.
  • error one of the following:
  • error
    • ZX_ERR_BAD_STATE if a long-running call such as Execute, Cleanse, Minimize, Fuzz, or Merge is in progress.
    • ZX_ERR_NOT_SUPPORTED if a value provided for an option is not supported by the engine. Check the logs for additional details.
source

pub fn get_options(&self) -> QueryResponseFut<Options>

Gets the current values for the various execution and error detection parameters.

  • response options the execution and error detection parameters.
source

pub fn add_to_corpus( &self, corpus: Corpus, input: Input ) -> QueryResponseFut<ControllerAddToCorpusResult>

Writes the provided input to either the “seed” or “live” corpus. Returns an error if transferring the input fails; see Input for details.

  • request corpus the type of corpus to add to.
  • request input the sequence of bytes to add as a test input.
  • error one of the following:
    • ZX_ERR_INVALID_ARGS if corpus type is invalid.
    • A socket error if transferring the input fails.
source

pub fn read_corpus( &self, corpus: Corpus, corpus_reader: ClientEnd<CorpusReaderMarker> ) -> QueryResponseFut<()>

Connects a corpus_reader for either the “seed” or “live” corpus.

  • request corpus the type of corpus to read from.
  • request corpus_reader the client used to send test inputs.
source

pub fn write_dictionary( &self, dictionary: Input ) -> QueryResponseFut<ControllerWriteDictionaryResult>

Parses and loads an AFL-style dictionary. Invalid entries are logged and skipped.

See also:

  • https://github.com/mirrorer/afl/blob/master/dictionaries/README.dictionaries
  • request dictionary the AFL-style dictionary
  • error one of the following:
    • A socket error if transferring the input fails. *ZX_ERR_INVALID_ARGS if parsing the dictionary fails.
source

pub fn read_dictionary(&self) -> QueryResponseFut<Input>

Returns the current dictionary as an Input, which may be empty.

  • response dictionary the current AFL-style dictionary.
source

pub fn add_monitor( &self, monitor: ClientEnd<MonitorMarker> ) -> QueryResponseFut<()>

Installs a Monitor to push status. To pull status instead, use GetStatus.

  • request monitor the client used to send status updates.
source

pub fn fuzz(&self) -> QueryResponseFut<ControllerFuzzResult>

Runs the normal fuzzing feedback loop:

  1. Selects an input from the corpus.
  2. Mutates the input.
  3. Uses the TargetAdapter to execute the input.
  4. Checks feedback from the InstrumentedProcesses.
  5. If the input produced useful feedback, adds it to the corpus.

This call returns quickly, but the loop continues until one of three conditions is met:

  1. The configured, non-zero number of runs has been reached.
  2. The configured, non-zero duration elapses.
  3. An error is detected, and returned.

See Result for more details on long running workflows such as this one.

  • error ZX_ERR_BAD_STATE if another long-running workflow is in progress.
source

pub fn try_one( &self, test_input: Input ) -> QueryResponseFut<ControllerTryOneResult>

Executes the target code with a single test_input.

See Result for more details on long running workflows such as this one.

  • request input the sequence of bytes to use with the fuzz target.
  • error one of the following:
    • ZX_ERR_BAD_STATE if another long-running workflow is in progress.
    • A socket error if transferring the input fails.
source

pub fn minimize( &self, test_input: Input ) -> QueryResponseFut<ControllerMinimizeResult>

Attempts to find the smallest input that produces the same error as the given test_input, constrained by the configured total_time and/or runs options.

See Result for more details on long running workflows such as this one.

  • request input the sequence of bytes to minimize.
  • error one of the following:
    • ZX_ERR_BAD_STATE if another long-running workflow is in progress.
    • A socket error if transferring the input fails.
    • ZX_ERR_INVALID_ARGS if the provided test_input does not cause an error.
source

pub fn cleanse( &self, test_input: Input ) -> QueryResponseFut<ControllerCleanseResult>

Attempts to replace bytes of the given test_input with “filler” bytes, e.g. \x00, \xFF, without changing the error produced.

See Result for more details on long running workflows such as this one.

To preserve backwards compatibility with libFuzzer and ClusterFuzz, an input that produces no result is not considered an error, and is returned as-is.

  • request input the sequence of bytes to cleanse.
  • error one of the following:
    • ZX_ERR_BAD_STATE if another long-running workflow is in progress.
    • A socket error if transferring the input fails.
source

pub fn merge(&self) -> QueryResponseFut<ControllerMergeResult>

Attempts to shrink the corpora. Inputs from the seed corpus will be preserved. All other inputs will be sorted by amount of feedback produced and input size, and only those inputs that add new feedback not seen earlier in the sequence will be kept.

See Result for more details on long running workflows such as this one.

  • error one of the following:
    • ZX_ERR_BAD_STATE if another long-running workflow is in progress.
    • ZX_ERR_INVALID_ARGS if an input in the seed corpus causes an error. Inputs in the live corpus that cause errors are skipped.
source

pub fn get_status(&self) -> QueryResponseFut<Status>

Returns various fuzzing metrics, e.g. total coverage, speed, etc.

  • response status the current value of fuzzing metrics.
source

pub fn watch_artifact(&self) -> QueryResponseFut<Artifact>

Returns the results of a long-running workflow.

This method uses the “hanging get” pattern. Upon the first call for a given connection, it will immediately return the controller’s current artifact. Upon subsequent calls, it will block until the controller’s artifact changes before returning. Clients should use GetStatus to ensure the fuzzer is not idle before making a blocking call to WatchArtifact.

Combined with the Status.running value obtained from GetStatus, this allows a (re-)connecting client to infer the state of the fuzzer:

  • If the fuzzer is idle and has an empty artifact, then it is unchanged since the last connection, if any.
  • If the fuzzer is running and has an empty artifact, then it is performing a long-running workflow started by a previous connection. The client may call WatchArtifact again to wait for the workflow to complete.
  • If the fuzzer is idle and has a non-empty artifact, then it has completed a long-running workflow since the last connection.

It is not an error for clients to disconnect while waiting for a response from this method. This method is intended to allow clients to resume waiting for a long-running workflow to complete after intentionally or inadvertently being disconnected for an indefinite amount of time.

  • response artifact the most recent result and/or error-causing input.

Trait Implementations§

source§

impl Clone for ControllerProxy

source§

fn clone(&self) -> ControllerProxy

Returns a copy of the value. Read more
1.0.0 · source§

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source. Read more
source§

impl ControllerProxyInterface for ControllerProxy

§

type ConfigureResponseFut = QueryResponseFut<Result<(), i32>>

source§

fn configure(&self, options: &Options) -> Self::ConfigureResponseFut

§

type GetOptionsResponseFut = QueryResponseFut<Options>

source§

fn get_options(&self) -> Self::GetOptionsResponseFut

§

type AddToCorpusResponseFut = QueryResponseFut<Result<(), i32>>

source§

fn add_to_corpus( &self, corpus: Corpus, input: Input ) -> Self::AddToCorpusResponseFut

§

type ReadCorpusResponseFut = QueryResponseFut<()>

source§

fn read_corpus( &self, corpus: Corpus, corpus_reader: ClientEnd<CorpusReaderMarker> ) -> Self::ReadCorpusResponseFut

§

type WriteDictionaryResponseFut = QueryResponseFut<Result<(), i32>>

source§

fn write_dictionary( &self, dictionary: Input ) -> Self::WriteDictionaryResponseFut

§

type ReadDictionaryResponseFut = QueryResponseFut<Input>

source§

fn read_dictionary(&self) -> Self::ReadDictionaryResponseFut

§

type AddMonitorResponseFut = QueryResponseFut<()>

source§

fn add_monitor( &self, monitor: ClientEnd<MonitorMarker> ) -> Self::AddMonitorResponseFut

§

type FuzzResponseFut = QueryResponseFut<Result<(), i32>>

source§

fn fuzz(&self) -> Self::FuzzResponseFut

§

type TryOneResponseFut = QueryResponseFut<Result<(), i32>>

source§

fn try_one(&self, test_input: Input) -> Self::TryOneResponseFut

§

type MinimizeResponseFut = QueryResponseFut<Result<(), i32>>

source§

fn minimize(&self, test_input: Input) -> Self::MinimizeResponseFut

§

type CleanseResponseFut = QueryResponseFut<Result<(), i32>>

source§

fn cleanse(&self, test_input: Input) -> Self::CleanseResponseFut

§

type MergeResponseFut = QueryResponseFut<Result<(), i32>>

source§

fn merge(&self) -> Self::MergeResponseFut

§

type GetStatusResponseFut = QueryResponseFut<Status>

source§

fn get_status(&self) -> Self::GetStatusResponseFut

§

type WatchArtifactResponseFut = QueryResponseFut<Artifact>

source§

fn watch_artifact(&self) -> Self::WatchArtifactResponseFut

source§

impl Debug for ControllerProxy

source§

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter. Read more
source§

impl Proxy for ControllerProxy

§

type Protocol = ControllerMarker

The protocol which this Proxy controls.
source§

fn from_channel(inner: AsyncChannel) -> Self

Create a proxy over the given channel.
source§

fn into_channel(self) -> Result<AsyncChannel, Self>

Attempt to convert the proxy back into a channel. Read more
source§

fn as_channel(&self) -> &AsyncChannel

Get a reference to the proxy’s underlying channel. Read more
source§

fn into_client_end(self) -> Result<ClientEnd<Self::Protocol>, Self>

Attempt to convert the proxy back into a client end. Read more
source§

fn is_closed(&self) -> bool

Returns true if the proxy has received the PEER_CLOSED signal.
source§

fn on_closed(&self) -> OnSignals<'_>

Returns a future that completes when the proxy receives the PEER_CLOSED signal.

Auto Trait Implementations§

Blanket Implementations§

source§

impl<T> Any for T
where T: 'static + ?Sized,

source§

fn type_id(&self) -> TypeId

Gets the TypeId of self. Read more
source§

impl<T> Borrow<T> for T
where T: ?Sized,

source§

fn borrow(&self) -> &T

Immutably borrows from an owned value. Read more
source§

impl<T> BorrowMut<T> for T
where T: ?Sized,

source§

fn borrow_mut(&mut self) -> &mut T

Mutably borrows from an owned value. Read more
source§

impl<T> Encode<Ambiguous1> for T

source§

unsafe fn encode( self, _encoder: &mut Encoder<'_>, _offset: usize, _depth: Depth ) -> Result<(), Error>

Encodes the object into the encoder’s buffers. Any handles stored in the object are swapped for Handle::INVALID. Read more
source§

impl<T> Encode<Ambiguous2> for T

source§

unsafe fn encode( self, _encoder: &mut Encoder<'_>, _offset: usize, _depth: Depth ) -> Result<(), Error>

Encodes the object into the encoder’s buffers. Any handles stored in the object are swapped for Handle::INVALID. Read more
source§

impl<T> From<T> for T

source§

fn from(t: T) -> T

Returns the argument unchanged.

§

impl<T> Instrument for T

§

fn instrument(self, span: Span) -> Instrumented<Self>

Instruments this type with the provided [Span], returning an Instrumented wrapper. Read more
§

fn in_current_span(self) -> Instrumented<Self>

Instruments this type with the current Span, returning an Instrumented wrapper. Read more
source§

impl<T, U> Into<U> for T
where U: From<T>,

source§

fn into(self) -> U

Calls U::from(self).

That is, this conversion is whatever the implementation of From<T> for U chooses to do.

§

impl<T> Pointable for T

§

const ALIGN: usize = _

The alignment of pointer.
§

type Init = T

The type for initializers.
§

unsafe fn init(init: <T as Pointable>::Init) -> usize

Initializes a with the given initializer. Read more
§

unsafe fn deref<'a>(ptr: usize) -> &'a T

Dereferences the given pointer. Read more
§

unsafe fn deref_mut<'a>(ptr: usize) -> &'a mut T

Mutably dereferences the given pointer. Read more
§

unsafe fn drop(ptr: usize)

Drops the object pointed to by the given pointer. Read more
source§

impl<T> ToOwned for T
where T: Clone,

§

type Owned = T

The resulting type after obtaining ownership.
source§

fn to_owned(&self) -> T

Creates owned data from borrowed data, usually by cloning. Read more
source§

fn clone_into(&self, target: &mut T)

Uses borrowed data to replace owned data, usually by cloning. Read more
source§

impl<T, U> TryFrom<U> for T
where U: Into<T>,

§

type Error = Infallible

The type returned in the event of a conversion error.
source§

fn try_from(value: U) -> Result<T, <T as TryFrom<U>>::Error>

Performs the conversion.
source§

impl<T, U> TryInto<U> for T
where U: TryFrom<T>,

§

type Error = <U as TryFrom<T>>::Error

The type returned in the event of a conversion error.
source§

fn try_into(self) -> Result<U, <U as TryFrom<T>>::Error>

Performs the conversion.
§

impl<T> WithSubscriber for T

§

fn with_subscriber<S>(self, subscriber: S) -> WithDispatch<Self>
where S: Into<Dispatch>,

Attaches the provided Subscriber to this type, returning a [WithDispatch] wrapper. Read more
§

fn with_current_subscriber(self) -> WithDispatch<Self>

Attaches the current default Subscriber to this type, returning a [WithDispatch] wrapper. Read more