fuchsia_fuzzctl_fdomain/
controller.rs

1// Copyright 2022 The Fuchsia Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5use crate::constants::*;
6use crate::corpus;
7use crate::diagnostics::Forwarder;
8use crate::duration::deadline_after;
9use crate::input::{Input, InputPair};
10use crate::writer::{OutputSink, Writer};
11use anyhow::{Context as _, Error, Result, anyhow, bail};
12use flex_client::{self, ProxyHasDomain};
13use flex_fuchsia_fuzzer::{self as fuzz, Artifact as FidlArtifact};
14use fuchsia_async::Timer;
15use futures::future::{Either, pending};
16use futures::{Future, FutureExt, pin_mut, select, try_join};
17use std::cell::RefCell;
18use std::cmp::max;
19use std::path::Path;
20use zx_status as zx;
21
22/// Represents a `fuchsia.fuzzer.Controller` connection to a fuzzer.
23#[derive(Debug)]
24pub struct Controller<O: OutputSink> {
25    proxy: fuzz::ControllerProxy,
26    forwarder: Forwarder<O>,
27    min_timeout: i64,
28    timeout: RefCell<Option<i64>>,
29}
30
31impl<O: OutputSink> Controller<O> {
32    /// Returns a new Controller instance.
33    pub fn new(proxy: fuzz::ControllerProxy, writer: &Writer<O>) -> Self {
34        Self {
35            proxy,
36            forwarder: Forwarder::<O>::new(writer),
37            min_timeout: 60 * NANOS_PER_SECOND,
38            timeout: RefCell::new(None),
39        }
40    }
41
42    pub fn domain(&self) -> flex_client::ClientArg {
43        self.proxy.domain()
44    }
45
46    /// Registers the provided output socket with the forwarder.
47    pub fn set_output<P: AsRef<Path>>(
48        &mut self,
49        socket: flex_client::Socket,
50        output: fuzz::TestOutput,
51        logs_dir: &Option<P>,
52    ) -> Result<()> {
53        self.forwarder.set_output(socket, output, logs_dir)
54    }
55
56    /// Sets the minimum amount of time, in nanoseconds, before a workflow can time out.
57    ///
58    /// If a the `max_total_time` option is set for a workflow that hangs, it will eventually
59    /// timeout. This method can be used to specify the minimum duration that must elapse before a
60    /// workflow is considered hung. The default of 1 minute is usually appropriate, but this method
61    /// can be useful when testing.
62    ///
63    pub fn set_min_timeout(&mut self, min_timeout: i64) {
64        self.min_timeout = min_timeout;
65    }
66
67    /// Sets various execution and error detection parameters for the fuzzer.
68    ///
69    /// Returns an error if:
70    ///   * Communicating with the fuzzer fails
71    ///   * A long-running call such as `try_one`, `fuzz`, `cleanse`, `minimize`, or `merge` is in
72    ///     progress.
73    ///
74    pub async fn configure(&self, options: fuzz::Options) -> Result<()> {
75        self.set_timeout(&options, None);
76        let result =
77            self.proxy.configure(&options).await.context("fuchsia.fuzzer/Controller.Configure")?;
78        result.map_err(|status| {
79            anyhow!("fuchsia.fuzzer/Controller.Configure returned: ZX_ERR_{}", status)
80        })
81    }
82
83    /// Returns a fuzzer's current values for the various execution and error detection parameters.
84    ///
85    /// Returns an error if communicating with the fuzzer fails
86    ///
87    pub async fn get_options(&self) -> Result<fuzz::Options> {
88        self.proxy
89            .get_options()
90            .await
91            .map_err(Error::msg)
92            .context("`fuchsia.fuzzer.Controller/GetOptions` failed")
93    }
94
95    /// Recalculates the timeout for a long-running workflow based on the configured maximum total
96    /// time and reported elapsed time.
97    ///
98    /// Returns an error if communicating with the fuzzer fails
99    ///
100    pub async fn reset_timer(&self) -> Result<()> {
101        let options = self.get_options().await?;
102        let status = self.get_status().await?;
103        self.set_timeout(&options, Some(status));
104        Ok(())
105    }
106
107    // Sets a workflow timeout based on the maximum total time a fuzzer workflow is expected to run.
108    fn set_timeout(&self, options: &fuzz::Options, status: Option<fuzz::Status>) {
109        let elapsed = status.map(|s| s.elapsed.unwrap_or(0)).unwrap_or(0);
110        if let Some(max_total_time) = options.max_total_time {
111            let mut timeout_mut = self.timeout.borrow_mut();
112            match max_total_time {
113                0 => {
114                    *timeout_mut = None;
115                }
116                n => {
117                    *timeout_mut = Some(max(n * 2, self.min_timeout) - elapsed);
118                }
119            }
120        }
121    }
122
123    /// Retrieves test inputs from one of the fuzzer's corpora.
124    ///
125    /// The compacted corpus is saved to the `corpus_dir`. Returns details on how much data was
126    /// received.
127    ///
128    /// Returns an error if:
129    ///   * Communicating with the fuzzer fails.
130    ///   * One or more inputs fails to be received and saved.
131    ///
132    pub async fn read_corpus<P: AsRef<Path>>(
133        &self,
134        corpus_type: fuzz::Corpus,
135        corpus_dir: P,
136    ) -> Result<corpus::Stats> {
137        let (client_end, server_end) =
138            self.proxy.domain().create_endpoints::<fuzz::CorpusReaderMarker>();
139        let stream = server_end.into_stream();
140        let (_, corpus_stats) = try_join!(
141            async { self.proxy.read_corpus(corpus_type, client_end).await.map_err(Error::msg) },
142            async { corpus::read(stream, corpus_dir).await },
143        )
144        .context("`fuchsia.fuzzer.Controller/ReadCorpus` failed")?;
145        Ok(corpus_stats)
146    }
147
148    /// Adds a test input to one of the fuzzer's corpora.
149    ///
150    /// The `test_input` may be either a single file or a directory. Returns details on how much
151    /// data was sent.
152    ///
153    /// Returns an error if:
154    ///   * Converting the input to an `Input`/`fuchsia.fuzzer.Input` pair fails.
155    ///   * Communicating with the fuzzer fails
156    ///   * The fuzzer returns an error, e.g. if it failed to transfer the input.
157    ///
158    pub async fn add_to_corpus(
159        &self,
160        input_pairs: Vec<InputPair>,
161        corpus_type: fuzz::Corpus,
162    ) -> Result<corpus::Stats> {
163        let expected_num_inputs = input_pairs.len();
164        let expected_total_size =
165            input_pairs.iter().fold(0, |total, input_pair| total + input_pair.len());
166        let mut corpus_stats = corpus::Stats { num_inputs: 0, total_size: 0 };
167        for input_pair in input_pairs.into_iter() {
168            let (fidl_input, input) = input_pair.as_tuple();
169            let fidl_input_size = fidl_input.size;
170            let (result, _) = try_join!(
171                async {
172                    self.proxy.add_to_corpus(corpus_type, fidl_input).await.map_err(Error::msg)
173                },
174                input.send(),
175            )
176            .context("fuchsia.fuzzer/Controller.AddToCorpus failed")?;
177            if let Err(status) = result {
178                bail!(
179                    "fuchsia.fuzzer/Controller.AddToCorpus returned: ZX_ERR_{} \
180                       after writing {} of {} files ({} of {} bytes)",
181                    status,
182                    corpus_stats.num_inputs,
183                    expected_num_inputs,
184                    corpus_stats.total_size,
185                    expected_total_size
186                )
187            }
188            corpus_stats.num_inputs += 1;
189            corpus_stats.total_size += fidl_input_size;
190        }
191        Ok(corpus_stats)
192    }
193
194    /// Returns information about fuzzer execution.
195    ///
196    /// The status typically includes information such as how long the fuzzer has been running, how
197    /// many edges in the call graph have been covered, how large the corpus is, etc.
198    ///
199    /// Refer to `fuchsia.fuzzer.Status` for precise details on the returned information.
200    ///
201    pub async fn get_status(&self) -> Result<fuzz::Status> {
202        match self.proxy.get_status().await {
203            Err(fidl::Error::ClientChannelClosed { status, .. })
204                if status == zx::Status::PEER_CLOSED =>
205            {
206                return Ok(fuzz::Status::default());
207            }
208            Err(e) => bail!("`fuchsia.fuzzer.Controller/GetStatus` failed: {:?}", e),
209            Ok(fuzz_status) => Ok(fuzz_status),
210        }
211    }
212
213    /// Runs the fuzzer in a loop to generate and test new inputs.
214    ///
215    /// The fuzzer will continuously generate new inputs and tries them until one of four
216    /// conditions are met:
217    ///   * The number of inputs tested exceeds the configured number of `runs`.
218    ///   * The configured amount of `max_total_time` has elapsed.
219    ///   * An input triggers a fatal error, e.g. death by AddressSanitizer.
220    ///   * `fuchsia.fuzzer.Controller/Stop` is called.
221    ///
222    /// Returns an error if:
223    ///   * Either `runs` or `time` is provided but cannot be parsed to  a valid value.
224    ///   * Communicating with the fuzzer fails.
225    ///   * The fuzzer returns an error, e.g. it is already performing another workflow.
226    ///
227    pub async fn fuzz(&self) -> Result<()> {
228        let response = self.proxy.fuzz().await;
229        let status = check_response("Fuzz", response)?;
230        check_status("Fuzz", status)
231    }
232
233    /// Tries running the fuzzer once using the given input.
234    ///
235    /// Returns an error if:
236    ///   * Converting the input to an `Input`/`fuchsia.fuzzer.Input` pair fails.
237    ///   * Communicating with the fuzzer fails.
238    ///   * The fuzzer returns an error, e.g. it is already performing another workflow.
239    ///
240    pub async fn try_one(&self, input_pair: InputPair) -> Result<()> {
241        let (fidl_input, input) = input_pair.as_tuple();
242        let status = self.with_input("TryOne", self.proxy.try_one(fidl_input), input).await?;
243        check_status("TryOne", status)
244    }
245
246    /// Reduces the length of an error-causing input while preserving the error.
247    ///
248    /// The fuzzer will bound its attempt to find shorter inputs using the given `runs` or `time`,
249    /// if provided.
250    ///
251    /// Returns an error if:
252    ///   * Either `runs` or `time` is provided but cannot be parsed to  a valid value.
253    ///   * Converting the input to an `Input`/`fuchsia.fuzzer.Input` pair fails.
254    ///   * Communicating with the fuzzer fails.
255    ///   * The fuzzer returns an error, e.g. it is already performing another workflow.
256    ///   * The minimized input fails to be received and saved.
257    ///
258    pub async fn minimize(&self, input_pair: InputPair) -> Result<()> {
259        let (fidl_input, input) = input_pair.as_tuple();
260        let status = self.with_input("Minimize", self.proxy.minimize(fidl_input), input).await?;
261        match status {
262            zx::Status::INVALID_ARGS => bail!("the provided input did not cause an error"),
263            status => check_status("Minimize", status),
264        }
265    }
266
267    /// Replaces bytes in a error-causing input with PII-safe bytes, e.g. spaces.
268    ///
269    /// The fuzzer will try to reproduce the error caused by the input with each byte replaced by a
270    /// fixed number of "clean" candidates.
271    ///
272    /// Returns an error if:
273    ///   * Converting the input to an `Input`/`fuchsia.fuzzer.Input` pair fails.
274    ///   * Communicating with the fuzzer fails.
275    ///   * The fuzzer returns an error, e.g. it is already performing another workflow.
276    ///   * The cleansed input fails to be received and saved.
277    ///
278    pub async fn cleanse(&self, input_pair: InputPair) -> Result<()> {
279        let (fidl_input, input) = input_pair.as_tuple();
280        let status = self.with_input("Cleanse", self.proxy.cleanse(fidl_input), input).await?;
281        match status {
282            zx::Status::INVALID_ARGS => bail!("the provided input did not cause an error"),
283            status => check_status("Cleanse", status),
284        }
285    }
286
287    /// Removes inputs from the corpus that produce duplicate coverage.
288    ///
289    /// The fuzzer makes a finite number of passes over its seed and live corpora. The seed corpus
290    /// is unchanged, but the fuzzer will try to find the set of shortest inputs that preserves
291    /// coverage.
292    ///
293    /// Returns an error if:
294    ///   * Communicating with the fuzzer fails.
295    ///   * The fuzzer returns an error, e.g. it is already performing another workflow.
296    ///   * One or more inputs fails to be received and saved.
297    ///
298    pub async fn merge(&self) -> Result<()> {
299        let response = self.proxy.merge().await;
300        let status = check_response("Merge", response)?;
301        match status {
302            zx::Status::INVALID_ARGS => bail!("an input in the seed corpus triggered an error"),
303            status => check_status("Merge", status),
304        }
305    }
306
307    // Runs the given `fidl_fut` along with a future to send an `input`.
308    async fn with_input<F>(&self, name: &str, fidl_fut: F, input: Input) -> Result<zx::Status>
309    where
310        F: Future<Output = Result<Result<(), i32>, fidl::Error>>,
311    {
312        let fidl_fut = fidl_fut.fuse();
313        let send_fut = input.send().fuse();
314        let timer_fut = match deadline_after(*self.timeout.borrow()) {
315            Some(deadline) => Either::Left(Timer::new(deadline)),
316            None => Either::Right(pending()),
317        };
318        let timer_fut = timer_fut.fuse();
319        pin_mut!(fidl_fut, send_fut, timer_fut);
320        let mut remaining = 2;
321        let mut status = zx::Status::OK;
322        // If `fidl_fut` completes with e.g. `Ok(zx::Status::CANCELED)`, drop
323        // the `send_fut` and `forward_fut` futures.
324        while remaining > 0 && status == zx::Status::OK {
325            select! {
326                response = fidl_fut => {
327                    status = check_response(name, response)?;
328                    remaining -= 1;
329                }
330                result = send_fut => {
331                    result?;
332                    remaining -= 1;
333                }
334                _ = timer_fut => {
335                    bail!("workflow timed out");
336                }
337            };
338        }
339        Ok(status)
340    }
341    /// Waits for the results of a long-running workflow.
342    ///
343    /// The `fuchsia.fuzzer.Controller/WatchArtifact` method uses a
344    /// ["hanging get" pattern](https://fuchsia.dev/fuchsia-src/development/api/fidl#hanging-get).
345    /// The first call will return whatever the current artifact is for the fuzzer; subsequent calls
346    /// will block until the artifact changes. The implementation below may retry the FIDL method to
347    /// ensure it only returns `Ok(None)` on channel close.
348    ///
349    pub async fn watch_artifact(&self) -> Result<FidlArtifact> {
350        let watch_fut = || async move {
351            loop {
352                let artifact = self.proxy.watch_artifact().await?;
353                if artifact != FidlArtifact::default() {
354                    return Ok(artifact);
355                }
356            }
357        };
358        let watch_fut = watch_fut().fuse();
359        let forward_fut = self.forwarder.forward_all().fuse();
360        let timer_fut = match deadline_after(*self.timeout.borrow()) {
361            Some(deadline) => Either::Left(Timer::new(deadline)),
362            None => Either::Right(pending()),
363        };
364        let timer_fut = timer_fut.fuse();
365        pin_mut!(watch_fut, forward_fut, timer_fut);
366        let mut remaining = 2;
367        let mut fidl_artifact = FidlArtifact::default();
368        // If `fidl_fut` completes with e.g. `Ok(zx::Status::CANCELED)`, drop
369        // the `send_fut` and `forward_fut` futures.
370        while remaining > 0 {
371            select! {
372                result = watch_fut => {
373                    fidl_artifact = match result {
374                        Ok(fidl_artifact) => {
375                            if let Some(e) = fidl_artifact.error {
376                                bail!("workflow returned an error: ZX_ERR_{}", e);
377                            }
378                            fidl_artifact
379                        }
380                        Err(fidl::Error::ClientChannelClosed { status, .. }) if status == zx::Status::PEER_CLOSED => FidlArtifact { error: Some(zx::Status::CANCELED.into_raw()), ..Default::default() },
381                        Err(e) => bail!("fuchsia.fuzzer/Controller.WatchArtifact: {:?}", e),
382                    };
383                    remaining -= 1;
384                }
385                result = forward_fut => {
386                    result?;
387                    remaining -= 1;
388                }
389                _ = timer_fut => {
390                    bail!("workflow timed out");
391                }
392            };
393        }
394        Ok(fidl_artifact)
395    }
396}
397
398// Checks a FIDL response for generic errors.
399fn check_response(
400    name: &str,
401    response: Result<Result<(), i32>, fidl::Error>,
402) -> Result<zx::Status> {
403    match response {
404        Err(fidl::Error::ClientChannelClosed { status, .. })
405            if status == zx::Status::PEER_CLOSED =>
406        {
407            Ok(zx::Status::OK)
408        }
409        Err(e) => bail!("`fuchsia.fuzzer.Controller/{}` failed: {:?}", name, e),
410        Ok(Err(raw)) => Ok(zx::Status::from_raw(raw)),
411        Ok(Ok(())) => Ok(zx::Status::OK),
412    }
413}
414
415// Checks the result from a FIDL response for common errors.
416fn check_status(name: &str, status: zx::Status) -> Result<()> {
417    match status {
418        zx::Status::OK => Ok(()),
419        zx::Status::BAD_STATE => bail!("another long-running workflow is in progress"),
420        status => bail!("`fuchsia.fuzzer.Controller/{}` returned: ZX_ERR_{}", name, status),
421    }
422}
423
424#[cfg(test)]
425mod tests {
426    use crate::util::digest_path;
427    use anyhow::{Context as _, Result};
428    use flex_fuchsia_fuzzer::{self as fuzz, Result_ as FuzzResult};
429    use fuchsia_async as fasync;
430    use fuchsia_fuzzctl::{Controller, Input, InputPair};
431    use fuchsia_fuzzctl_test::{FakeController, Test, create_task, serve_controller, verify_saved};
432    use zx_status as zx;
433
434    // Creates a test setup suitable for unit testing `Controller`.
435    fn perform_test_setup(
436        test: &Test,
437    ) -> Result<(FakeController, fuzz::ControllerProxy, fasync::Task<()>)> {
438        let fake = test.controller();
439        let (proxy, stream) = test.domain().create_proxy_and_stream::<fuzz::ControllerMarker>();
440        let task = create_task(serve_controller(stream, test.clone()), test.writer());
441        Ok((fake, proxy, task))
442    }
443
444    #[fuchsia::test]
445    async fn test_configure() -> Result<()> {
446        let test = Test::try_new()?;
447        let (fake, proxy, _task) = perform_test_setup(&test)?;
448        let controller = Controller::new(proxy, test.writer());
449
450        // Modify all the options that start with 'd'.
451        let expected = fuzz::Options {
452            dictionary_level: Some(1),
453            detect_exits: Some(true),
454            detect_leaks: Some(false),
455            death_exitcode: Some(2),
456            debug: Some(true),
457            ..Default::default()
458        };
459        controller.configure(expected.clone()).await?;
460        let actual = fake.get_options();
461        assert_eq!(actual.dictionary_level, expected.dictionary_level);
462        assert_eq!(actual.detect_exits, expected.detect_exits);
463        assert_eq!(actual.detect_leaks, expected.detect_leaks);
464        assert_eq!(actual.death_exitcode, expected.death_exitcode);
465        assert_eq!(actual.debug, expected.debug);
466
467        Ok(())
468    }
469
470    #[fuchsia::test]
471    async fn test_get_options() -> Result<()> {
472        let test = Test::try_new()?;
473        let (fake, proxy, _task) = perform_test_setup(&test)?;
474        let controller = Controller::new(proxy, test.writer());
475
476        // Modify all the options that start with 'm'.
477        let expected = fuzz::Options {
478            max_total_time: Some(20000),
479            max_input_size: Some(2000),
480            mutation_depth: Some(20),
481            malloc_limit: Some(200),
482            malloc_exitcode: Some(2),
483            ..Default::default()
484        };
485        fake.set_options(expected.clone());
486        let actual = controller.get_options().await?;
487        assert_eq!(actual.max_total_time, expected.max_total_time);
488        assert_eq!(actual.max_input_size, expected.max_input_size);
489        assert_eq!(actual.mutation_depth, expected.mutation_depth);
490        assert_eq!(actual.malloc_limit, expected.malloc_limit);
491        assert_eq!(actual.malloc_exitcode, expected.malloc_exitcode);
492
493        Ok(())
494    }
495
496    #[fuchsia::test]
497    async fn test_read_corpus() -> Result<()> {
498        let test = Test::try_new()?;
499        let (fake, proxy, _task) = perform_test_setup(&test)?;
500        let controller = Controller::new(proxy, test.writer());
501
502        let seed_dir = test.create_dir("seed")?;
503        fake.set_input_to_send(b"foo");
504        let stats = controller.read_corpus(fuzz::Corpus::Seed, &seed_dir).await?;
505        assert_eq!(fake.get_corpus_type(), fuzz::Corpus::Seed);
506        assert_eq!(stats.num_inputs, 1);
507        assert_eq!(stats.total_size, 3);
508        let path = digest_path(&seed_dir, None, b"foo");
509        verify_saved(&path, b"foo")?;
510
511        let live_dir = test.create_dir("live")?;
512        fake.set_input_to_send(b"barbaz");
513        let stats = controller.read_corpus(fuzz::Corpus::Live, &live_dir).await?;
514        assert_eq!(fake.get_corpus_type(), fuzz::Corpus::Live);
515        assert_eq!(stats.num_inputs, 1);
516        assert_eq!(stats.total_size, 6);
517        let path = digest_path(&live_dir, None, b"barbaz");
518        verify_saved(&path, b"barbaz")?;
519
520        Ok(())
521    }
522
523    #[fuchsia::test]
524    async fn test_add_to_corpus() -> Result<()> {
525        let test = Test::try_new()?;
526        let (fake, proxy, _task) = perform_test_setup(&test)?;
527        let controller = Controller::new(proxy, test.writer());
528
529        let input_pairs: Vec<InputPair> = vec![b"foo".to_vec(), b"bar".to_vec(), b"baz".to_vec()]
530            .into_iter()
531            .map(|data| InputPair::try_from_data(&test.domain(), data).unwrap())
532            .collect();
533        let stats = controller.add_to_corpus(input_pairs, fuzz::Corpus::Seed).await?;
534        assert_eq!(fake.get_corpus_type(), fuzz::Corpus::Seed);
535        assert_eq!(stats.num_inputs, 3);
536        assert_eq!(stats.total_size, 9);
537
538        let input_pairs: Vec<InputPair> =
539            vec![b"qux".to_vec(), b"quux".to_vec(), b"corge".to_vec()]
540                .into_iter()
541                .map(|data| InputPair::try_from_data(&test.domain(), data).unwrap())
542                .collect();
543        let stats = controller.add_to_corpus(input_pairs, fuzz::Corpus::Live).await?;
544        assert_eq!(fake.get_corpus_type(), fuzz::Corpus::Live);
545        assert_eq!(stats.num_inputs, 3);
546        assert_eq!(stats.total_size, 12);
547
548        Ok(())
549    }
550
551    #[fuchsia::test]
552    async fn test_get_status() -> Result<()> {
553        let test = Test::try_new()?;
554        let (fake, proxy, _task) = perform_test_setup(&test)?;
555        let controller = Controller::new(proxy, test.writer());
556
557        let expected = fuzz::Status {
558            running: Some(true),
559            runs: Some(1),
560            elapsed: Some(2),
561            covered_pcs: Some(3),
562            covered_features: Some(4),
563            corpus_num_inputs: Some(5),
564            corpus_total_size: Some(6),
565            process_stats: None,
566            ..Default::default()
567        };
568        fake.set_status(expected.clone());
569        let actual = controller.get_status().await?;
570        assert_eq!(actual, expected);
571
572        Ok(())
573    }
574
575    #[fuchsia::test]
576    async fn test_try_one() -> Result<()> {
577        let test = Test::try_new()?;
578        let (fake, proxy, _task) = perform_test_setup(&test)?;
579        let controller = Controller::new(proxy, test.writer());
580
581        let input_pair = InputPair::try_from_data(&test.domain(), b"foo".to_vec())?;
582        controller.try_one(input_pair).await?;
583        let artifact = controller.watch_artifact().await?;
584        assert_eq!(artifact.error, None);
585        assert_eq!(artifact.result, Some(FuzzResult::NoErrors));
586
587        fake.set_result(Ok(FuzzResult::Crash));
588        let input_pair = InputPair::try_from_data(&test.domain(), b"bar".to_vec())?;
589        controller.try_one(input_pair).await?;
590        let artifact = controller.watch_artifact().await?;
591        assert_eq!(artifact.error, None);
592        assert_eq!(artifact.result, Some(FuzzResult::Crash));
593
594        fake.cancel();
595        let input_pair = InputPair::try_from_data(&test.domain(), b"baz".to_vec())?;
596        controller.try_one(input_pair).await?;
597        let artifact = controller.watch_artifact().await?;
598        assert_eq!(artifact.error, Some(zx::Status::CANCELED.into_raw()));
599
600        Ok(())
601    }
602
603    #[fuchsia::test]
604    async fn test_fuzz() -> Result<()> {
605        let test = Test::try_new()?;
606        let (fake, proxy, _task) = perform_test_setup(&test)?;
607        let controller = Controller::new(proxy, test.writer());
608
609        let options = fuzz::Options { runs: Some(10), ..Default::default() };
610        controller.configure(options).await?;
611        controller.fuzz().await?;
612        let artifact = controller.watch_artifact().await?;
613        assert_eq!(artifact.error, None);
614        assert_eq!(artifact.result, Some(FuzzResult::NoErrors));
615
616        fake.set_result(Ok(FuzzResult::Death));
617        fake.set_input_to_send(b"foo");
618        controller.fuzz().await?;
619        let artifact = controller.watch_artifact().await?;
620        assert_eq!(artifact.error, None);
621        assert_eq!(artifact.result, Some(FuzzResult::Death));
622
623        let fidl_input = artifact.input.context("invalid FIDL artifact")?;
624        let input = Input::try_receive(fidl_input).await?;
625        assert_eq!(input.data, b"foo");
626
627        fake.cancel();
628        controller.fuzz().await?;
629        let artifact = controller.watch_artifact().await?;
630        assert_eq!(artifact.error, Some(zx::Status::CANCELED.into_raw()));
631
632        Ok(())
633    }
634
635    #[fuchsia::test]
636    async fn test_minimize() -> Result<()> {
637        let test = Test::try_new()?;
638        let (fake, proxy, _task) = perform_test_setup(&test)?;
639        let controller = Controller::new(proxy, test.writer());
640
641        fake.set_input_to_send(b"foo");
642        let input_pair = InputPair::try_from_data(&test.domain(), b"foofoofoo".to_vec())?;
643        controller.minimize(input_pair).await?;
644        let artifact = controller.watch_artifact().await?;
645        assert_eq!(artifact.error, None);
646        assert_eq!(artifact.result, Some(FuzzResult::Minimized));
647
648        let fidl_input = artifact.input.context("invalid FIDL artifact")?;
649        let input = Input::try_receive(fidl_input).await?;
650        assert_eq!(input.data, b"foo");
651
652        fake.cancel();
653        let input_pair = InputPair::try_from_data(&test.domain(), b"bar".to_vec())?;
654        controller.minimize(input_pair).await?;
655        let artifact = controller.watch_artifact().await?;
656        assert_eq!(artifact.error, Some(zx::Status::CANCELED.into_raw()));
657
658        Ok(())
659    }
660
661    #[fuchsia::test]
662    async fn test_cleanse() -> Result<()> {
663        let test = Test::try_new()?;
664        let (fake, proxy, _task) = perform_test_setup(&test)?;
665        let controller = Controller::new(proxy, test.writer());
666
667        fake.set_input_to_send(b"   bar   ");
668        let input_pair = InputPair::try_from_data(&test.domain(), b"foobarbaz".to_vec())?;
669        controller.cleanse(input_pair).await?;
670        let artifact = controller.watch_artifact().await?;
671        assert_eq!(artifact.error, None);
672        assert_eq!(artifact.result, Some(FuzzResult::Cleansed));
673
674        let fidl_input = artifact.input.context("invalid FIDL artifact")?;
675        let input = Input::try_receive(fidl_input).await?;
676        assert_eq!(input.data, b"   bar   ");
677
678        fake.cancel();
679        let input_pair = InputPair::try_from_data(&test.domain(), b"foobarbaz".to_vec())?;
680        controller.cleanse(input_pair).await?;
681        let artifact = controller.watch_artifact().await?;
682        assert_eq!(artifact.error, Some(zx::Status::CANCELED.into_raw()));
683
684        Ok(())
685    }
686
687    #[fuchsia::test]
688    async fn test_merge() -> Result<()> {
689        let test = Test::try_new()?;
690        let (fake, proxy, _task) = perform_test_setup(&test)?;
691        let controller = Controller::new(proxy, test.writer());
692
693        controller.merge().await?;
694        let artifact = controller.watch_artifact().await?;
695        assert_eq!(artifact.error, None);
696        assert_eq!(artifact.result, Some(FuzzResult::Merged));
697
698        fake.cancel();
699        controller.merge().await?;
700        let artifact = controller.watch_artifact().await?;
701        assert_eq!(artifact.error, Some(zx::Status::CANCELED.into_raw()));
702
703        Ok(())
704    }
705}
fuchsia_fuzzctl_fdomain/controller.rs

fuchsia_fuzzctl_fdomain/
controller.rs
