mock_server_base.cc

Go to the documentation of this file.

/*
 * Copyright (C) Max Dymond, <cmeister2@gmail.com>, et al.
 *
 * SPDX-License-Identifier: curl
 */

 
#include "proto_fuzzer/mock_server_base.h"
 
#include <curl/multi.h>
#include <sys/select.h>
 
#include <cstdio>
 
#include "proto_fuzzer/allocation_fault_injection.h"
#include "proto_fuzzer/curl_raii.h"
#include "proto_fuzzer/mock_server.h"
#include "proto_fuzzer/multi_socket_driver.h"
 
namespace proto_fuzzer {
 
namespace {
 
constexpr long kSelectTimeoutUs = 1000;  // 1 ms; explicit timing cases only.

CURL** GetHandlesForCleanup(CURLM* multi) {
  allocation_fault_injection::ScopedFailureSuppression suppress_failures;
  return curl_multi_get_handles(multi);
}
 
}  // namespace

curl_socket_t MockServerBaseOpenSocketTrampoline(void* clientp, curlsocktype purpose, struct curl_sockaddr* address) {
  return static_cast<MockServerBase*>(clientp)->HandleOpenSocket(purpose, address);
}

int MockServerBaseSockOptTrampoline(void* clientp, curl_socket_t curlfd, curlsocktype purpose) {
  const auto disposition = static_cast<MockServerBase*>(clientp)->GetSocketSetupDisposition(curlfd, purpose);
  return disposition == SocketSetupDisposition::kAlreadyConnected ? CURL_SOCKOPT_ALREADY_CONNECTED : CURL_SOCKOPT_OK;
}

MockServerBase::MockServerBase(MultiDrivePolicy drive_policy)
    : connection_(nullptr),
      pending_recv_buf_bytes_(0),
      pending_drain_limit_(0),
      multi_socket_driver_(nullptr),
      additional_handle_cleanup_count_(0),
      resume_response_(false),
      drive_policy_(drive_policy) {}

MockServerBase::~MockServerBase() = default;

void MockServerBase::ObserveState() {}

MockConnection* MockServerBase::connection() { return connection_.get(); }

void MockServerBase::Install(CURL* easy) {
  curl_easy_setopt(easy, CURLOPT_OPENSOCKETFUNCTION, &MockServerBaseOpenSocketTrampoline);
  curl_easy_setopt(easy, CURLOPT_OPENSOCKETDATA, this);
  curl_easy_setopt(easy, CURLOPT_SOCKOPTFUNCTION, &MockServerBaseSockOptTrampoline);
  curl_easy_setopt(easy, CURLOPT_SOCKOPTDATA, this);
}

SocketSetupDisposition MockServerBase::GetSocketSetupDisposition(curl_socket_t /*curlfd*/, curlsocktype purpose) const {
  // curl itself accepted CURLSOCKTYPE_ACCEPT descriptors, so they must follow
  // its normal post-accept option path. Every IPCXN socket returned by the
  // ordinary stream mocks is one end of an already-connected socketpair.
  return purpose == CURLSOCKTYPE_ACCEPT ? SocketSetupDisposition::kNeedsSetup
                                        : SocketSetupDisposition::kAlreadyConnected;
}

void MockServerBase::ConfigureRequestData(ScenarioRequestData* /*request_data*/) {}

CURLcode MockServerBase::DriveScenario(CURL* easy, const curl::fuzzer::proto::Scenario& scenario) {
  const curl::fuzzer::proto::ApiPlan* api_plan =
      drive_policy_ == MultiDrivePolicy::kFromApiPlan && scenario.has_api_plan() ? &scenario.api_plan() : nullptr;
  const bool use_multi_socket =
      drive_policy_ == MultiDrivePolicy::kSocketAction ||
      (api_plan != nullptr && api_plan->drive_mode() == curl::fuzzer::proto::API_DRIVE_MULTI_SOCKET);
 
  // Cache backpressure knobs so HandleOpenSocket can apply them the moment
  // connection_ exists. Both default to 0, which matches the legacy "drain
  // greedily, kernel-default buffers" behaviour exactly.
  const auto& bp = scenario.connection().backpressure();
  pending_recv_buf_bytes_ = static_cast<int>(bp.recv_buf_bytes());
  pending_drain_limit_ = static_cast<std::size_t>(bp.drain_limit());
  additional_handle_cleanup_count_ = 0;
  resume_response_ = api_plan != nullptr && api_plan->pause_response_once();
 
  CurlMultiPtr multi(curl_multi_init());
  if (multi == nullptr) {
    resume_response_ = false;
    return CURLE_FAILED_INIT;
  }
 
  CURLcode transfer_result = CURLE_FAILED_INIT;
 
  // Callback data must survive both remove_handle and multi_cleanup, since
  // either may emit CURL_POLL_REMOVE. Keeping it in this outer scope provides
  // that lifetime without allocating per-watch state.
  MultiSocketDriver socket_driver;
  if (use_multi_socket && socket_driver.Install(multi.get())) {
    multi_socket_driver_ = &socket_driver;
  }
  if (curl_multi_add_handle(multi.get(), easy) == CURLM_OK) {
    if (multi_observer_) {
      multi_observer_(multi.get());
    }
    if (api_plan != nullptr && api_plan->wake_multi()) {
      if (multi_socket_driver_ != nullptr) {
        multi_socket_driver_->ProbeControlApis();
      } else {
        long timeout_ms = -1;
        (void)curl_multi_timeout(multi.get(), &timeout_ms);
        (void)curl_multi_wakeup(multi.get());
      }
    }
    RunLoop(multi.get(), easy, scenario);
 
    // Completion messages are the multi API's only durable record of the
    // transfer result. Consume them while all easy handles are still attached:
    // otherwise every scenario systematically skips curl_multi_info_read's
    // result path and removal discards the opportunity. An accepted HTTP/2
    // push can contribute one additional completion message; only the caller's
    // parent determines DriveScenario's result.
    int messages_remaining = 0;
    CURLMsg* message = nullptr;
    while ((message = curl_multi_info_read(multi.get(), &messages_remaining)) != nullptr) {
      if (message->msg == CURLMSG_DONE && message->easy_handle == easy) {
        transfer_result = message->data.result;
      }
    }
 
    // CURL_PUSH_OK transfers ownership of each automatically-added easy to
    // the application. Enumerate attached handles only after draining their
    // completion messages, then honor the public remove-before-cleanup
    // lifecycle. The original `easy` remains caller-owned.
    CURL** handles = GetHandlesForCleanup(multi.get());
    if (handles != nullptr) {
      for (std::size_t index = 0; handles[index] != nullptr; ++index) {
        CURL* handle = handles[index];
        if (handle != easy && curl_multi_remove_handle(multi.get(), handle) == CURLM_OK) {
          curl_easy_cleanup(handle);
          ++additional_handle_cleanup_count_;
        }
      }
      curl_free(handles);
    }
 
    curl_multi_remove_handle(multi.get(), easy);
  }
  // Socket-action callbacks borrow the stack driver above, so that path must
  // clean its multi before this function returns. Perform-based protocol mocks
  // may retain the detached multi when their fixed lifecycle requires it.
  if (use_multi_socket) {
    multi.reset();
  } else {
    HandleDetachedMulti(std::move(multi));
  }
  multi_socket_driver_ = nullptr;
  if (socket_driver.watch_exhausted()) {
    std::fputs("curl-fuzzer: socket watch capacity exhausted\n", stderr);
  }
  resume_response_ = false;
  return transfer_result;
}

void MockServerBase::HandleDetachedMulti(CurlMultiPtr /*multi*/) {}

CURLcode MockServerBase::DriveEasyScenario(CURL* easy, const curl::fuzzer::proto::Scenario& scenario,
                                           bool /*use_events*/) {
  return DriveScenario(easy, scenario);
}

ConnectOnlyRunStats MockServerBase::DriveConnectOnlyScenario(CURL* easy,
                                                             const curl::fuzzer::proto::Scenario& scenario) {
  ConnectOnlyRunStats stats;
  stats.connect_result = DriveScenario(easy, scenario);
  return stats;
}

MultiSocketDriver* MockServerBase::multi_socket_driver() { return multi_socket_driver_; }

std::size_t MockServerBase::additional_handle_cleanup_count() const { return additional_handle_cleanup_count_; }

void MockServerBase::ResumeResponseIfRequested(CURL* easy) {
  if (resume_response_) {
    (void)curl_easy_pause(easy, CURLPAUSE_CONT);
  }
}

void MockServerBase::ApplyPendingBackpressure() {
  if (connection_) {
    connection_->ApplyBackpressure(pending_recv_buf_bytes_, pending_drain_limit_);
  }
}

bool MockServerBase::UsesTimedDrive(const curl::fuzzer::proto::Scenario& scenario) {
  const auto& bp = scenario.connection().backpressure();
  return bp.recv_buf_bytes() != 0 || bp.drain_limit() != 0;
}

int MockServerBase::WaitOnMultiFdset(CURLM* multi, CURLMcode* rc) {
  fd_set readfds;
  fd_set writefds;
  fd_set excfds;
  FD_ZERO(&readfds);
  FD_ZERO(&writefds);
  FD_ZERO(&excfds);
  int maxfd = -1;
  *rc = curl_multi_fdset(multi, &readfds, &writefds, &excfds, &maxfd);
  if (*rc != CURLM_OK) {
    return -1;
  }
  if (maxfd < 0) {
    return 0;
  }
  struct timeval timeout;
  timeout.tv_sec = 0;
  timeout.tv_usec = kSelectTimeoutUs;
  return ::select(maxfd + 1, &readfds, &writefds, &excfds, &timeout);
}

void MockServerBase::ProbeMultiPollset(CURLM* multi) {
  int numfds = 0;
  (void)curl_multi_poll(multi, nullptr, 0, 0, &numfds);
}

bool MockServerBase::MultiPollsetWantsWrite(CURLM* multi, curl_socket_t socket) {
  if (multi == nullptr || socket == CURL_SOCKET_BAD || socket < 0 || socket >= FD_SETSIZE) {
    return false;
  }
  fd_set readfds;
  fd_set writefds;
  fd_set excfds;
  FD_ZERO(&readfds);
  FD_ZERO(&writefds);
  FD_ZERO(&excfds);
  int maxfd = -1;
  if (curl_multi_fdset(multi, &readfds, &writefds, &excfds, &maxfd) != CURLM_OK) {
    return false;
  }
  return socket <= maxfd && FD_ISSET(socket, &writefds);
}
 
}  // namespace proto_fuzzer