fuchsia_fuzzctl_fdomain/
controller.rs

1// Copyright 2022 The Fuchsia Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5use crate::constants::*;
6use crate::corpus;
7use crate::diagnostics::Forwarder;
8use crate::duration::deadline_after;
9use crate::input::{Input, InputPair};
10use crate::writer::{OutputSink, Writer};
11use anyhow::{Context as _, Error, Result, anyhow, bail};
12use flex_client::{self, ProxyHasDomain};
13use flex_fuchsia_fuzzer::{self as fuzz, Artifact as FidlArtifact};
14use fuchsia_async::Timer;
15use futures::future::{Either, pending};
16use futures::{Future, FutureExt, pin_mut, select, try_join};
17use std::cell::RefCell;
18use std::cmp::max;
19use std::path::Path;
20use zx_status as zx;
21
22/// Represents a `fuchsia.fuzzer.Controller` connection to a fuzzer.
23#[derive(Debug)]
24pub struct Controller<O: OutputSink> {
25    proxy: fuzz::ControllerProxy,
26    forwarder: Forwarder<O>,
27    min_timeout: i64,
28    timeout: RefCell<Option<i64>>,
29}
30
31impl<O: OutputSink> Controller<O> {
32    /// Returns a new Controller instance.
33    pub fn new(proxy: fuzz::ControllerProxy, writer: &Writer<O>) -> Self {
34        Self {
35            proxy,
36            forwarder: Forwarder::<O>::new(writer),
37            min_timeout: 60 * NANOS_PER_SECOND,
38            timeout: RefCell::new(None),
39        }
40    }
41
42    pub fn domain(&self) -> flex_client::ClientArg {
43        self.proxy.domain()
44    }
45
46    /// Registers the provided output socket with the forwarder.
47    pub fn set_output<P: AsRef<Path>>(
48        &mut self,
49        socket: flex_client::Socket,
50        output: fuzz::TestOutput,
51        logs_dir: &Option<P>,
52    ) -> Result<()> {
53        self.forwarder.set_output(socket, output, logs_dir)
54    }
55
56    /// Sets the minimum amount of time, in nanoseconds, before a workflow can time out.
57    ///
58    /// If a the `max_total_time` option is set for a workflow that hangs, it will eventually
59    /// timeout. This method can be used to specify the minimum duration that must elapse before a
60    /// workflow is considered hung. The default of 1 minute is usually appropriate, but this method
61    /// can be useful when testing.
62    ///
63    pub fn set_min_timeout(&mut self, min_timeout: i64) {
64        self.min_timeout = min_timeout;
65    }
66
67    /// Sets various execution and error detection parameters for the fuzzer.
68    ///
69    /// Returns an error if:
70    ///   * Communicating with the fuzzer fails
71    ///   * A long-running call such as `try_one`, `fuzz`, `cleanse`, `minimize`, or `merge` is in
72    ///     progress.
73    ///
74    pub async fn configure(&self, options: fuzz::Options) -> Result<()> {
75        self.set_timeout(&options, None);
76        let result =
77            self.proxy.configure(&options).await.context("fuchsia.fuzzer/Controller.Configure")?;
78        result.map_err(|status| {
79            anyhow!("fuchsia.fuzzer/Controller.Configure returned: ZX_ERR_{}", status)
80        })
81    }
82
83    /// Returns a fuzzer's current values for the various execution and error detection parameters.
84    ///
85    /// Returns an error if communicating with the fuzzer fails
86    ///
87    pub async fn get_options(&self) -> Result<fuzz::Options> {
88        self.proxy
89            .get_options()
90            .await
91            .map_err(Error::msg)
92            .context("`fuchsia.fuzzer.Controller/GetOptions` failed")
93    }
94
95    /// Recalculates the timeout for a long-running workflow based on the configured maximum total
96    /// time and reported elapsed time.
97    ///
98    /// Returns an error if communicating with the fuzzer fails
99    ///
100    pub async fn reset_timer(&self) -> Result<()> {
101        let options = self.get_options().await?;
102        let status = self.get_status().await?;
103        self.set_timeout(&options, Some(status));
104        Ok(())
105    }
106
107    // Sets a workflow timeout based on the maximum total time a fuzzer workflow is expected to run.
108    fn set_timeout(&self, options: &fuzz::Options, status: Option<fuzz::Status>) {
109        let elapsed = status.map(|s| s.elapsed.unwrap_or(0)).unwrap_or(0);
110        if let Some(max_total_time) = options.max_total_time {
111            let mut timeout_mut = self.timeout.borrow_mut();
112            match max_total_time {
113                0 => {
114                    *timeout_mut = None;
115                }
116                n => {
117                    *timeout_mut = Some(max(n * 2, self.min_timeout) - elapsed);
118                }
119            }
120        }
121    }
122
123    /// Retrieves test inputs from one of the fuzzer's corpora.
124    ///
125    /// The compacted corpus is saved to the `corpus_dir`. Returns details on how much data was
126    /// received.
127    ///
128    /// Returns an error if:
129    ///   * Communicating with the fuzzer fails.
130    ///   * One or more inputs fails to be received and saved.
131    ///
132    pub async fn read_corpus<P: AsRef<Path>>(
133        &self,
134        corpus_type: fuzz::Corpus,
135        corpus_dir: P,
136    ) -> Result<corpus::Stats> {
137        let (client_end, server_end) =
138            self.proxy.domain().create_endpoints::<fuzz::CorpusReaderMarker>();
139        let stream = server_end.into_stream();
140        let (_, corpus_stats) = try_join!(
141            async { self.proxy.read_corpus(corpus_type, client_end).await.map_err(Error::msg) },
142            async { corpus::read(stream, corpus_dir).await },
143        )
144        .context("`fuchsia.fuzzer.Controller/ReadCorpus` failed")?;
145        Ok(corpus_stats)
146    }
147
148    /// Adds a test input to one of the fuzzer's corpora.
149    ///
150    /// The `test_input` may be either a single file or a directory. Returns details on how much
151    /// data was sent.
152    ///
153    /// Returns an error if:
154    ///   * Converting the input to an `Input`/`fuchsia.fuzzer.Input` pair fails.
155    ///   * Communicating with the fuzzer fails
156    ///   * The fuzzer returns an error, e.g. if it failed to transfer the input.
157    ///
158    pub async fn add_to_corpus(
159        &self,
160        input_pairs: Vec<InputPair>,
161        corpus_type: fuzz::Corpus,
162    ) -> Result<corpus::Stats> {
163        let expected_num_inputs = input_pairs.len();
164        let expected_total_size =
165            input_pairs.iter().fold(0, |total, input_pair| total + input_pair.len());
166        let mut corpus_stats = corpus::Stats { num_inputs: 0, total_size: 0 };
167        for input_pair in input_pairs.into_iter() {
168            let (fidl_input, input) = input_pair.as_tuple();
169            let fidl_input_size = fidl_input.size;
170            let (result, _) = try_join!(
171                async {
172                    self.proxy.add_to_corpus(corpus_type, fidl_input).await.map_err(Error::msg)
173                },
174                input.send(),
175            )
176            .context("fuchsia.fuzzer/Controller.AddToCorpus failed")?;
177            if let Err(status) = result {
178                bail!(
179                    "fuchsia.fuzzer/Controller.AddToCorpus returned: ZX_ERR_{} \
180                       after writing {} of {} files ({} of {} bytes)",
181                    status,
182                    corpus_stats.num_inputs,
183                    expected_num_inputs,
184                    corpus_stats.total_size,
185                    expected_total_size
186                )
187            }
188            corpus_stats.num_inputs += 1;
189            corpus_stats.total_size += fidl_input_size;
190        }
191        Ok(corpus_stats)
192    }
193
194    /// Returns information about fuzzer execution.
195    ///
196    /// The status typically includes information such as how long the fuzzer has been running, how
197    /// many edges in the call graph have been covered, how large the corpus is, etc.
198    ///
199    /// Refer to `fuchsia.fuzzer.Status` for precise details on the returned information.
200    ///
201    pub async fn get_status(&self) -> Result<fuzz::Status> {
202        match self.proxy.get_status().await {
203            Err(fidl::Error::ClientChannelClosed { epitaph, .. })
204                if epitaph == zx::Status::PEER_CLOSED =>
205            {
206                return Ok(fuzz::Status::default());
207            }
208            Err(e) => bail!("`fuchsia.fuzzer.Controller/GetStatus` failed: {:?}", e),
209            Ok(fuzz_status) => Ok(fuzz_status),
210        }
211    }
212
213    /// Runs the fuzzer in a loop to generate and test new inputs.
214    ///
215    /// The fuzzer will continuously generate new inputs and tries them until one of four
216    /// conditions are met:
217    ///   * The number of inputs tested exceeds the configured number of `runs`.
218    ///   * The configured amount of `max_total_time` has elapsed.
219    ///   * An input triggers a fatal error, e.g. death by AddressSanitizer.
220    ///   * `fuchsia.fuzzer.Controller/Stop` is called.
221    ///
222    /// Returns an error if:
223    ///   * Either `runs` or `time` is provided but cannot be parsed to  a valid value.
224    ///   * Communicating with the fuzzer fails.
225    ///   * The fuzzer returns an error, e.g. it is already performing another workflow.
226    ///
227    pub async fn fuzz(&self) -> Result<()> {
228        let response = self.proxy.fuzz().await;
229        let status = check_response("Fuzz", response)?;
230        check_status("Fuzz", status)
231    }
232
233    /// Tries running the fuzzer once using the given input.
234    ///
235    /// Returns an error if:
236    ///   * Converting the input to an `Input`/`fuchsia.fuzzer.Input` pair fails.
237    ///   * Communicating with the fuzzer fails.
238    ///   * The fuzzer returns an error, e.g. it is already performing another workflow.
239    ///
240    pub async fn try_one(&self, input_pair: InputPair) -> Result<()> {
241        let (fidl_input, input) = input_pair.as_tuple();
242        let status = self.with_input("TryOne", self.proxy.try_one(fidl_input), input).await?;
243        check_status("TryOne", status)
244    }
245
246    /// Reduces the length of an error-causing input while preserving the error.
247    ///
248    /// The fuzzer will bound its attempt to find shorter inputs using the given `runs` or `time`,
249    /// if provided.
250    ///
251    /// Returns an error if:
252    ///   * Either `runs` or `time` is provided but cannot be parsed to  a valid value.
253    ///   * Converting the input to an `Input`/`fuchsia.fuzzer.Input` pair fails.
254    ///   * Communicating with the fuzzer fails.
255    ///   * The fuzzer returns an error, e.g. it is already performing another workflow.
256    ///   * The minimized input fails to be received and saved.
257    ///
258    pub async fn minimize(&self, input_pair: InputPair) -> Result<()> {
259        let (fidl_input, input) = input_pair.as_tuple();
260        let status = self.with_input("Minimize", self.proxy.minimize(fidl_input), input).await?;
261        match status {
262            zx::Status::INVALID_ARGS => bail!("the provided input did not cause an error"),
263            status => check_status("Minimize", status),
264        }
265    }
266
267    /// Replaces bytes in a error-causing input with PII-safe bytes, e.g. spaces.
268    ///
269    /// The fuzzer will try to reproduce the error caused by the input with each byte replaced by a
270    /// fixed number of "clean" candidates.
271    ///
272    /// Returns an error if:
273    ///   * Converting the input to an `Input`/`fuchsia.fuzzer.Input` pair fails.
274    ///   * Communicating with the fuzzer fails.
275    ///   * The fuzzer returns an error, e.g. it is already performing another workflow.
276    ///   * The cleansed input fails to be received and saved.
277    ///
278    pub async fn cleanse(&self, input_pair: InputPair) -> Result<()> {
279        let (fidl_input, input) = input_pair.as_tuple();
280        let status = self.with_input("Cleanse", self.proxy.cleanse(fidl_input), input).await?;
281        match status {
282            zx::Status::INVALID_ARGS => bail!("the provided input did not cause an error"),
283            status => check_status("Cleanse", status),
284        }
285    }
286
287    /// Removes inputs from the corpus that produce duplicate coverage.
288    ///
289    /// The fuzzer makes a finite number of passes over its seed and live corpora. The seed corpus
290    /// is unchanged, but the fuzzer will try to find the set of shortest inputs that preserves
291    /// coverage.
292    ///
293    /// Returns an error if:
294    ///   * Communicating with the fuzzer fails.
295    ///   * The fuzzer returns an error, e.g. it is already performing another workflow.
296    ///   * One or more inputs fails to be received and saved.
297    ///
298    pub async fn merge(&self) -> Result<()> {
299        let response = self.proxy.merge().await;
300        let status = check_response("Merge", response)?;
301        match status {
302            zx::Status::INVALID_ARGS => bail!("an input in the seed corpus triggered an error"),
303            status => check_status("Merge", status),
304        }
305    }
306
307    // Runs the given `fidl_fut` along with a future to send an `input`.
308    async fn with_input<F>(&self, name: &str, fidl_fut: F, input: Input) -> Result<zx::Status>
309    where
310        F: Future<Output = Result<Result<(), i32>, fidl::Error>>,
311    {
312        let fidl_fut = fidl_fut.fuse();
313        let send_fut = input.send().fuse();
314        let timer_fut = match deadline_after(*self.timeout.borrow()) {
315            Some(deadline) => Either::Left(Timer::new(deadline)),
316            None => Either::Right(pending()),
317        };
318        let timer_fut = timer_fut.fuse();
319        pin_mut!(fidl_fut, send_fut, timer_fut);
320        let mut remaining = 2;
321        let mut status = zx::Status::OK;
322        // If `fidl_fut` completes with e.g. `Ok(zx::Status::CANCELED)`, drop
323        // the `send_fut` and `forward_fut` futures.
324        while remaining > 0 && status == zx::Status::OK {
325            select! {
326                response = fidl_fut => {
327                    status = check_response(name, response)?;
328                    remaining -= 1;
329                }
330                result = send_fut => {
331                    result?;
332                    remaining -= 1;
333                }
334                _ = timer_fut => {
335                    bail!("workflow timed out");
336                }
337            };
338        }
339        Ok(status)
340    }
341    /// Waits for the results of a long-running workflow.
342    ///
343    /// The `fuchsia.fuzzer.Controller/WatchArtifact` method uses a
344    /// ["hanging get" pattern](https://fuchsia.dev/fuchsia-src/development/api/fidl#hanging-get).
345    /// The first call will return whatever the current artifact is for the fuzzer; subsequent calls
346    /// will block until the artifact changes. The implementation below may retry the FIDL method to
347    /// ensure it only returns `Ok(None)` on channel close.
348    ///
349    pub async fn watch_artifact(&self) -> Result<FidlArtifact> {
350        let watch_fut = || async move {
351            loop {
352                let artifact = self.proxy.watch_artifact().await?;
353                if artifact != FidlArtifact::default() {
354                    return Ok(artifact);
355                }
356            }
357        };
358        let watch_fut = watch_fut().fuse();
359        let forward_fut = self.forwarder.forward_all().fuse();
360        let timer_fut = match deadline_after(*self.timeout.borrow()) {
361            Some(deadline) => Either::Left(Timer::new(deadline)),
362            None => Either::Right(pending()),
363        };
364        let timer_fut = timer_fut.fuse();
365        pin_mut!(watch_fut, forward_fut, timer_fut);
366        let mut remaining = 2;
367        let mut fidl_artifact = FidlArtifact::default();
368        // If `fidl_fut` completes with e.g. `Ok(zx::Status::CANCELED)`, drop
369        // the `send_fut` and `forward_fut` futures.
370        while remaining > 0 {
371            select! {
372                result = watch_fut => {
373                    fidl_artifact = match result {
374                        Ok(fidl_artifact) => {
375                            if let Some(e) = fidl_artifact.error {
376                                bail!("workflow returned an error: ZX_ERR_{}", e);
377                            }
378                            fidl_artifact
379                        }
380                        Err(fidl::Error::ClientChannelClosed { epitaph, .. })
381                            if epitaph == zx::Status::PEER_CLOSED =>
382                        {
383                            FidlArtifact {
384                                error: Some(zx::Status::CANCELED.into_raw()),
385                                ..Default::default()
386                            }
387                        }
388                        Err(e) => bail!("fuchsia.fuzzer/Controller.WatchArtifact: {:?}", e),
389                    };
390                    remaining -= 1;
391                }
392                result = forward_fut => {
393                    result?;
394                    remaining -= 1;
395                }
396                _ = timer_fut => {
397                    bail!("workflow timed out");
398                }
399            };
400        }
401        Ok(fidl_artifact)
402    }
403}
404
405// Checks a FIDL response for generic errors.
406fn check_response(
407    name: &str,
408    response: Result<Result<(), i32>, fidl::Error>,
409) -> Result<zx::Status> {
410    match response {
411        Err(fidl::Error::ClientChannelClosed { epitaph, .. })
412            if epitaph == zx::Status::PEER_CLOSED =>
413        {
414            Ok(zx::Status::OK)
415        }
416        Err(e) => bail!("`fuchsia.fuzzer.Controller/{}` failed: {:?}", name, e),
417        Ok(Err(raw)) => Ok(zx::Status::from_raw(raw)),
418        Ok(Ok(())) => Ok(zx::Status::OK),
419    }
420}
421
422// Checks the result from a FIDL response for common errors.
423fn check_status(name: &str, status: zx::Status) -> Result<()> {
424    match status {
425        zx::Status::OK => Ok(()),
426        zx::Status::BAD_STATE => bail!("another long-running workflow is in progress"),
427        status => bail!("`fuchsia.fuzzer.Controller/{}` returned: ZX_ERR_{}", name, status),
428    }
429}
430
431#[cfg(test)]
432mod tests {
433    use crate::util::digest_path;
434    use anyhow::{Context as _, Result};
435    use flex_fuchsia_fuzzer::{self as fuzz, Result_ as FuzzResult};
436    use fuchsia_async as fasync;
437    use fuchsia_fuzzctl::{Controller, Input, InputPair};
438    use fuchsia_fuzzctl_test::{FakeController, Test, create_task, serve_controller, verify_saved};
439    use zx_status as zx;
440
441    // Creates a test setup suitable for unit testing `Controller`.
442    fn perform_test_setup(
443        test: &Test,
444    ) -> Result<(FakeController, fuzz::ControllerProxy, fasync::Task<()>)> {
445        let fake = test.controller();
446        let (proxy, stream) = test.domain().create_proxy_and_stream::<fuzz::ControllerMarker>();
447        let task = create_task(serve_controller(stream, test.clone()), test.writer());
448        Ok((fake, proxy, task))
449    }
450
451    #[fuchsia::test]
452    async fn test_configure() -> Result<()> {
453        let test = Test::try_new()?;
454        let (fake, proxy, _task) = perform_test_setup(&test)?;
455        let controller = Controller::new(proxy, test.writer());
456
457        // Modify all the options that start with 'd'.
458        let expected = fuzz::Options {
459            dictionary_level: Some(1),
460            detect_exits: Some(true),
461            detect_leaks: Some(false),
462            death_exitcode: Some(2),
463            debug: Some(true),
464            ..Default::default()
465        };
466        controller.configure(expected.clone()).await?;
467        let actual = fake.get_options();
468        assert_eq!(actual.dictionary_level, expected.dictionary_level);
469        assert_eq!(actual.detect_exits, expected.detect_exits);
470        assert_eq!(actual.detect_leaks, expected.detect_leaks);
471        assert_eq!(actual.death_exitcode, expected.death_exitcode);
472        assert_eq!(actual.debug, expected.debug);
473
474        Ok(())
475    }
476
477    #[fuchsia::test]
478    async fn test_get_options() -> Result<()> {
479        let test = Test::try_new()?;
480        let (fake, proxy, _task) = perform_test_setup(&test)?;
481        let controller = Controller::new(proxy, test.writer());
482
483        // Modify all the options that start with 'm'.
484        let expected = fuzz::Options {
485            max_total_time: Some(20000),
486            max_input_size: Some(2000),
487            mutation_depth: Some(20),
488            malloc_limit: Some(200),
489            malloc_exitcode: Some(2),
490            ..Default::default()
491        };
492        fake.set_options(expected.clone());
493        let actual = controller.get_options().await?;
494        assert_eq!(actual.max_total_time, expected.max_total_time);
495        assert_eq!(actual.max_input_size, expected.max_input_size);
496        assert_eq!(actual.mutation_depth, expected.mutation_depth);
497        assert_eq!(actual.malloc_limit, expected.malloc_limit);
498        assert_eq!(actual.malloc_exitcode, expected.malloc_exitcode);
499
500        Ok(())
501    }
502
503    #[fuchsia::test]
504    async fn test_read_corpus() -> Result<()> {
505        let test = Test::try_new()?;
506        let (fake, proxy, _task) = perform_test_setup(&test)?;
507        let controller = Controller::new(proxy, test.writer());
508
509        let seed_dir = test.create_dir("seed")?;
510        fake.set_input_to_send(b"foo");
511        let stats = controller.read_corpus(fuzz::Corpus::Seed, &seed_dir).await?;
512        assert_eq!(fake.get_corpus_type(), fuzz::Corpus::Seed);
513        assert_eq!(stats.num_inputs, 1);
514        assert_eq!(stats.total_size, 3);
515        let path = digest_path(&seed_dir, None, b"foo");
516        verify_saved(&path, b"foo")?;
517
518        let live_dir = test.create_dir("live")?;
519        fake.set_input_to_send(b"barbaz");
520        let stats = controller.read_corpus(fuzz::Corpus::Live, &live_dir).await?;
521        assert_eq!(fake.get_corpus_type(), fuzz::Corpus::Live);
522        assert_eq!(stats.num_inputs, 1);
523        assert_eq!(stats.total_size, 6);
524        let path = digest_path(&live_dir, None, b"barbaz");
525        verify_saved(&path, b"barbaz")?;
526
527        Ok(())
528    }
529
530    #[fuchsia::test]
531    async fn test_add_to_corpus() -> Result<()> {
532        let test = Test::try_new()?;
533        let (fake, proxy, _task) = perform_test_setup(&test)?;
534        let controller = Controller::new(proxy, test.writer());
535
536        let input_pairs: Vec<InputPair> = vec![b"foo".to_vec(), b"bar".to_vec(), b"baz".to_vec()]
537            .into_iter()
538            .map(|data| InputPair::try_from_data(&test.domain(), data).unwrap())
539            .collect();
540        let stats = controller.add_to_corpus(input_pairs, fuzz::Corpus::Seed).await?;
541        assert_eq!(fake.get_corpus_type(), fuzz::Corpus::Seed);
542        assert_eq!(stats.num_inputs, 3);
543        assert_eq!(stats.total_size, 9);
544
545        let input_pairs: Vec<InputPair> =
546            vec![b"qux".to_vec(), b"quux".to_vec(), b"corge".to_vec()]
547                .into_iter()
548                .map(|data| InputPair::try_from_data(&test.domain(), data).unwrap())
549                .collect();
550        let stats = controller.add_to_corpus(input_pairs, fuzz::Corpus::Live).await?;
551        assert_eq!(fake.get_corpus_type(), fuzz::Corpus::Live);
552        assert_eq!(stats.num_inputs, 3);
553        assert_eq!(stats.total_size, 12);
554
555        Ok(())
556    }
557
558    #[fuchsia::test]
559    async fn test_get_status() -> Result<()> {
560        let test = Test::try_new()?;
561        let (fake, proxy, _task) = perform_test_setup(&test)?;
562        let controller = Controller::new(proxy, test.writer());
563
564        let expected = fuzz::Status {
565            running: Some(true),
566            runs: Some(1),
567            elapsed: Some(2),
568            covered_pcs: Some(3),
569            covered_features: Some(4),
570            corpus_num_inputs: Some(5),
571            corpus_total_size: Some(6),
572            process_stats: None,
573            ..Default::default()
574        };
575        fake.set_status(expected.clone());
576        let actual = controller.get_status().await?;
577        assert_eq!(actual, expected);
578
579        Ok(())
580    }
581
582    #[fuchsia::test]
583    async fn test_try_one() -> Result<()> {
584        let test = Test::try_new()?;
585        let (fake, proxy, _task) = perform_test_setup(&test)?;
586        let controller = Controller::new(proxy, test.writer());
587
588        let input_pair = InputPair::try_from_data(&test.domain(), b"foo".to_vec())?;
589        controller.try_one(input_pair).await?;
590        let artifact = controller.watch_artifact().await?;
591        assert_eq!(artifact.error, None);
592        assert_eq!(artifact.result, Some(FuzzResult::NoErrors));
593
594        fake.set_result(Ok(FuzzResult::Crash));
595        let input_pair = InputPair::try_from_data(&test.domain(), b"bar".to_vec())?;
596        controller.try_one(input_pair).await?;
597        let artifact = controller.watch_artifact().await?;
598        assert_eq!(artifact.error, None);
599        assert_eq!(artifact.result, Some(FuzzResult::Crash));
600
601        fake.cancel();
602        let input_pair = InputPair::try_from_data(&test.domain(), b"baz".to_vec())?;
603        controller.try_one(input_pair).await?;
604        let artifact = controller.watch_artifact().await?;
605        assert_eq!(artifact.error, Some(zx::Status::CANCELED.into_raw()));
606
607        Ok(())
608    }
609
610    #[fuchsia::test]
611    async fn test_fuzz() -> Result<()> {
612        let test = Test::try_new()?;
613        let (fake, proxy, _task) = perform_test_setup(&test)?;
614        let controller = Controller::new(proxy, test.writer());
615
616        let options = fuzz::Options { runs: Some(10), ..Default::default() };
617        controller.configure(options).await?;
618        controller.fuzz().await?;
619        let artifact = controller.watch_artifact().await?;
620        assert_eq!(artifact.error, None);
621        assert_eq!(artifact.result, Some(FuzzResult::NoErrors));
622
623        fake.set_result(Ok(FuzzResult::Death));
624        fake.set_input_to_send(b"foo");
625        controller.fuzz().await?;
626        let artifact = controller.watch_artifact().await?;
627        assert_eq!(artifact.error, None);
628        assert_eq!(artifact.result, Some(FuzzResult::Death));
629
630        let fidl_input = artifact.input.context("invalid FIDL artifact")?;
631        let input = Input::try_receive(fidl_input).await?;
632        assert_eq!(input.data, b"foo");
633
634        fake.cancel();
635        controller.fuzz().await?;
636        let artifact = controller.watch_artifact().await?;
637        assert_eq!(artifact.error, Some(zx::Status::CANCELED.into_raw()));
638
639        Ok(())
640    }
641
642    #[fuchsia::test]
643    async fn test_minimize() -> Result<()> {
644        let test = Test::try_new()?;
645        let (fake, proxy, _task) = perform_test_setup(&test)?;
646        let controller = Controller::new(proxy, test.writer());
647
648        fake.set_input_to_send(b"foo");
649        let input_pair = InputPair::try_from_data(&test.domain(), b"foofoofoo".to_vec())?;
650        controller.minimize(input_pair).await?;
651        let artifact = controller.watch_artifact().await?;
652        assert_eq!(artifact.error, None);
653        assert_eq!(artifact.result, Some(FuzzResult::Minimized));
654
655        let fidl_input = artifact.input.context("invalid FIDL artifact")?;
656        let input = Input::try_receive(fidl_input).await?;
657        assert_eq!(input.data, b"foo");
658
659        fake.cancel();
660        let input_pair = InputPair::try_from_data(&test.domain(), b"bar".to_vec())?;
661        controller.minimize(input_pair).await?;
662        let artifact = controller.watch_artifact().await?;
663        assert_eq!(artifact.error, Some(zx::Status::CANCELED.into_raw()));
664
665        Ok(())
666    }
667
668    #[fuchsia::test]
669    async fn test_cleanse() -> Result<()> {
670        let test = Test::try_new()?;
671        let (fake, proxy, _task) = perform_test_setup(&test)?;
672        let controller = Controller::new(proxy, test.writer());
673
674        fake.set_input_to_send(b"   bar   ");
675        let input_pair = InputPair::try_from_data(&test.domain(), b"foobarbaz".to_vec())?;
676        controller.cleanse(input_pair).await?;
677        let artifact = controller.watch_artifact().await?;
678        assert_eq!(artifact.error, None);
679        assert_eq!(artifact.result, Some(FuzzResult::Cleansed));
680
681        let fidl_input = artifact.input.context("invalid FIDL artifact")?;
682        let input = Input::try_receive(fidl_input).await?;
683        assert_eq!(input.data, b"   bar   ");
684
685        fake.cancel();
686        let input_pair = InputPair::try_from_data(&test.domain(), b"foobarbaz".to_vec())?;
687        controller.cleanse(input_pair).await?;
688        let artifact = controller.watch_artifact().await?;
689        assert_eq!(artifact.error, Some(zx::Status::CANCELED.into_raw()));
690
691        Ok(())
692    }
693
694    #[fuchsia::test]
695    async fn test_merge() -> Result<()> {
696        let test = Test::try_new()?;
697        let (fake, proxy, _task) = perform_test_setup(&test)?;
698        let controller = Controller::new(proxy, test.writer());
699
700        controller.merge().await?;
701        let artifact = controller.watch_artifact().await?;
702        assert_eq!(artifact.error, None);
703        assert_eq!(artifact.result, Some(FuzzResult::Merged));
704
705        fake.cancel();
706        controller.merge().await?;
707        let artifact = controller.watch_artifact().await?;
708        assert_eq!(artifact.error, Some(zx::Status::CANCELED.into_raw()));
709
710        Ok(())
711    }
712}
fuchsia_fuzzctl_fdomain/controller.rs

fuchsia_fuzzctl_fdomain/
controller.rs
