pub struct ControllerSynchronousProxy { /* private fields */ }
Implementations§
source§impl ControllerSynchronousProxy
impl ControllerSynchronousProxy
pub fn new(channel: Channel) -> Self
pub fn into_channel(self) -> Channel
sourcepub fn wait_for_event(
&self,
deadline: MonotonicInstant,
) -> Result<ControllerEvent, Error>
pub fn wait_for_event( &self, deadline: MonotonicInstant, ) -> Result<ControllerEvent, Error>
Waits until an event arrives and returns it. It is safe for other threads to make concurrent requests while waiting for an event.
sourcepub fn configure(
&self,
options: &Options,
___deadline: MonotonicInstant,
) -> Result<ControllerConfigureResult, Error>
pub fn configure( &self, options: &Options, ___deadline: MonotonicInstant, ) -> Result<ControllerConfigureResult, Error>
Sets various execution and error detection parameters. This may be
called multiple times; only the most recently received options are used.
If the Options
parameter omits one or more fields, those parameters
are unchanged in the fuzzer. Until the initial call to this method, the
fuzzer should assume the default values for Options
.
- request
options
the execution and error detection parameters.
- error one of the following:
- error
ZX_ERR_BAD_STATE
if a long-running call such asExecute
,Cleanse
,Minimize
,Fuzz
, orMerge
is in progress.ZX_ERR_NOT_SUPPORTED
if a value provided for an option is not supported by the engine. Check the logs for additional details.
sourcepub fn get_options(
&self,
___deadline: MonotonicInstant,
) -> Result<Options, Error>
pub fn get_options( &self, ___deadline: MonotonicInstant, ) -> Result<Options, Error>
Gets the current values for the various execution and error detection parameters.
- response
options
the execution and error detection parameters.
sourcepub fn add_to_corpus(
&self,
corpus: Corpus,
input: Input,
___deadline: MonotonicInstant,
) -> Result<ControllerAddToCorpusResult, Error>
pub fn add_to_corpus( &self, corpus: Corpus, input: Input, ___deadline: MonotonicInstant, ) -> Result<ControllerAddToCorpusResult, Error>
Writes the provided input
to either the “seed” or “live” corpus
.
Returns an error if transferring the input fails; see Input
for
details.
- request
corpus
the type of corpus to add to. - request
input
the sequence of bytes to add as a test input.
- error one of the following:
ZX_ERR_INVALID_ARGS
if corpus type is invalid.- A socket error if transferring the input fails.
sourcepub fn read_corpus(
&self,
corpus: Corpus,
corpus_reader: ClientEnd<CorpusReaderMarker>,
___deadline: MonotonicInstant,
) -> Result<(), Error>
pub fn read_corpus( &self, corpus: Corpus, corpus_reader: ClientEnd<CorpusReaderMarker>, ___deadline: MonotonicInstant, ) -> Result<(), Error>
Connects a corpus_reader
for either the “seed” or “live” corpus.
- request
corpus
the type of corpus to read from. - request
corpus_reader
the client used to send test inputs.
sourcepub fn write_dictionary(
&self,
dictionary: Input,
___deadline: MonotonicInstant,
) -> Result<ControllerWriteDictionaryResult, Error>
pub fn write_dictionary( &self, dictionary: Input, ___deadline: MonotonicInstant, ) -> Result<ControllerWriteDictionaryResult, Error>
Parses and loads an AFL-style dictionary. Invalid entries are logged and skipped.
See also:
- https://github.com/mirrorer/afl/blob/master/dictionaries/README.dictionaries
- request
dictionary
the AFL-style dictionary
- error one of the following:
- A socket error if transferring the input fails.
*
ZX_ERR_INVALID_ARGS
if parsing the dictionary fails.
- A socket error if transferring the input fails.
*
sourcepub fn read_dictionary(
&self,
___deadline: MonotonicInstant,
) -> Result<Input, Error>
pub fn read_dictionary( &self, ___deadline: MonotonicInstant, ) -> Result<Input, Error>
Returns the current dictionary as an Input, which may be empty.
- response
dictionary
the current AFL-style dictionary.
sourcepub fn add_monitor(
&self,
monitor: ClientEnd<MonitorMarker>,
___deadline: MonotonicInstant,
) -> Result<(), Error>
pub fn add_monitor( &self, monitor: ClientEnd<MonitorMarker>, ___deadline: MonotonicInstant, ) -> Result<(), Error>
Installs a Monitor
to push status. To pull status instead, use
GetStatus
.
- request
monitor
the client used to send status updates.
sourcepub fn fuzz(
&self,
___deadline: MonotonicInstant,
) -> Result<ControllerFuzzResult, Error>
pub fn fuzz( &self, ___deadline: MonotonicInstant, ) -> Result<ControllerFuzzResult, Error>
Runs the normal fuzzing feedback loop:
- Selects an input from the corpus.
- Mutates the input.
- Uses the
TargetAdapter
to execute the input. - Checks feedback from the
InstrumentedProcesses
. - If the input produced useful feedback, adds it to the corpus.
This call returns quickly, but the loop continues until one of three conditions is met:
- The configured, non-zero number of
runs
has been reached. - The configured, non-zero
duration
elapses. - An error is detected, and returned.
See Result
for more details on long running workflows such as this
one.
- error
ZX_ERR_BAD_STATE
if another long-running workflow is in progress.
sourcepub fn try_one(
&self,
test_input: Input,
___deadline: MonotonicInstant,
) -> Result<ControllerTryOneResult, Error>
pub fn try_one( &self, test_input: Input, ___deadline: MonotonicInstant, ) -> Result<ControllerTryOneResult, Error>
Executes the target code with a single test_input
.
See Result
for more details on long running workflows such as this
one.
- request
input
the sequence of bytes to use with the fuzz target.
- error one of the following:
ZX_ERR_BAD_STATE
if another long-running workflow is in progress.- A socket error if transferring the input fails.
sourcepub fn minimize(
&self,
test_input: Input,
___deadline: MonotonicInstant,
) -> Result<ControllerMinimizeResult, Error>
pub fn minimize( &self, test_input: Input, ___deadline: MonotonicInstant, ) -> Result<ControllerMinimizeResult, Error>
Attempts to find the smallest input that produces the same error as the
given test_input
,
constrained by the configured total_time
and/or runs
options.
See Result
for more details on long running workflows such as this
one.
- request
input
the sequence of bytes to minimize.
- error one of the following:
ZX_ERR_BAD_STATE
if another long-running workflow is in progress.- A socket error if transferring the input fails.
ZX_ERR_INVALID_ARGS
if the providedtest_input
does not cause an error.
sourcepub fn cleanse(
&self,
test_input: Input,
___deadline: MonotonicInstant,
) -> Result<ControllerCleanseResult, Error>
pub fn cleanse( &self, test_input: Input, ___deadline: MonotonicInstant, ) -> Result<ControllerCleanseResult, Error>
Attempts to replace bytes of the given test_input
with “filler” bytes,
e.g. \x00, \xFF, without changing the error produced.
See Result
for more details on long running workflows such as this
one.
To preserve backwards compatibility with libFuzzer and ClusterFuzz, an input that produces no result is not considered an error, and is returned as-is.
- request
input
the sequence of bytes to cleanse.
- error one of the following:
ZX_ERR_BAD_STATE
if another long-running workflow is in progress.- A socket error if transferring the input fails.
sourcepub fn merge(
&self,
___deadline: MonotonicInstant,
) -> Result<ControllerMergeResult, Error>
pub fn merge( &self, ___deadline: MonotonicInstant, ) -> Result<ControllerMergeResult, Error>
Attempts to shrink the corpora. Inputs from the seed corpus will be preserved. All other inputs will be sorted by amount of feedback produced and input size, and only those inputs that add new feedback not seen earlier in the sequence will be kept.
See Result
for more details on long running workflows such as this
one.
- error one of the following:
ZX_ERR_BAD_STATE
if another long-running workflow is in progress.ZX_ERR_INVALID_ARGS
if an input in the seed corpus causes an error. Inputs in the live corpus that cause errors are skipped.
sourcepub fn get_status(&self, ___deadline: MonotonicInstant) -> Result<Status, Error>
pub fn get_status(&self, ___deadline: MonotonicInstant) -> Result<Status, Error>
Returns various fuzzing metrics, e.g. total coverage, speed, etc.
- response
status
the current value of fuzzing metrics.
sourcepub fn watch_artifact(
&self,
___deadline: MonotonicInstant,
) -> Result<Artifact, Error>
pub fn watch_artifact( &self, ___deadline: MonotonicInstant, ) -> Result<Artifact, Error>
Returns the results of a long-running workflow.
This method uses the
“hanging get” pattern.
Upon the first call for a given connection, it will immediately return
the controller’s current artifact. Upon subsequent calls, it will block
until the controller’s artifact changes before returning. Clients should
use GetStatus
to ensure the fuzzer is not idle before making a
blocking call to WatchArtifact
.
Combined with the Status.running
value obtained from GetStatus
, this
allows a (re-)connecting client to infer the state of the fuzzer:
- If the fuzzer is idle and has an empty artifact, then it is unchanged since the last connection, if any.
- If the fuzzer is running and has an empty artifact, then it is
performing a long-running workflow started by a previous connection.
The client may call
WatchArtifact
again to wait for the workflow to complete. - If the fuzzer is idle and has a non-empty artifact, then it has completed a long-running workflow since the last connection.
It is not an error for clients to disconnect while waiting for a response from this method. This method is intended to allow clients to resume waiting for a long-running workflow to complete after intentionally or inadvertently being disconnected for an indefinite amount of time.
- response
artifact
the most recent result and/or error-causing input.
Trait Implementations§
source§impl Debug for ControllerSynchronousProxy
impl Debug for ControllerSynchronousProxy
source§impl SynchronousProxy for ControllerSynchronousProxy
impl SynchronousProxy for ControllerSynchronousProxy
§type Proxy = ControllerProxy
type Proxy = ControllerProxy
§type Protocol = ControllerMarker
type Protocol = ControllerMarker
Proxy
controls.