telnet_mock_server.cc

Go to the documentation of this file.

/*
 * Copyright (C) Max Dymond, <cmeister2@gmail.com>, et al.
 *
 * SPDX-License-Identifier: curl
 */

 
#include "proto_fuzzer/telnet_mock_server.h"
 
#include <algorithm>
#include <cstddef>
#include <memory>
#include <string>
 
#include "proto_fuzzer/mock_server.h"
#include "proto_fuzzer/request_data.h"
#include "proto_fuzzer/scenario_limits.h"
#include "proto_fuzzer/telnet_scenario.h"
 
namespace proto_fuzzer {
 
namespace {
 
// BoundTelnetResponse limits worst-case negotiation output to well below this
// floor. Rejecting a surprising platform socket configuration is preferable
// to letting curl's blocking POLLOUT path become a fuzzer timeout.
constexpr std::size_t kMinClientSendBufferBytes = 64 * 1024;
 
// curl currently builds each TTYPE, XDISPLOC, or NEW_ENV reply in a fixed
// 2048-byte buffer. Charging that whole buffer to every retained IAC is more
// conservative than curl's protocol grammar, while doubled upload bytes and a
// generous allowance for initial/small negotiation frames cover the remaining
// writes that can accumulate before the pre-read drain runs.
constexpr std::size_t kCurlTelnetSuboptionReplyBytes = 2048;
constexpr std::size_t kSmallNegotiationHeadroomBytes = 4 * 1024;
constexpr std::size_t kMaxBufferedClientBytes =
    scenario_limits::kMaxTelnetControlBytes * kCurlTelnetSuboptionReplyBytes +
    2 * scenario_limits::kMaxTelnetUploadBytes + kSmallNegotiationHeadroomBytes;
static_assert(kMaxBufferedClientBytes <= kMinClientSendBufferBytes,
              "TELNET mutation caps exceed the verified client send buffer");

void CopyTelnetResponsePrefix(const curl::fuzzer::proto::Connection& source,
                              curl::fuzzer::proto::Connection* destination) {
  std::size_t bytes_left = scenario_limits::kMaxTelnetResponseBytes;
  const auto copy_fragment = [&bytes_left](const std::string& fragment, std::string* output) {
    const std::size_t retained = std::min(fragment.size(), bytes_left);
    output->assign(fragment.data(), retained);
    bytes_left -= retained;
    return retained == fragment.size();
  };
 
  if (!copy_fragment(source.initial_response(), destination->mutable_initial_response())) {
    return;
  }
 
  const std::size_t chunk_count =
      std::min<std::size_t>(scenario_limits::kMaxTelnetResponseChunks, source.on_readable_size());
  for (std::size_t index = 0; index < chunk_count && bytes_left != 0; ++index) {
    if (!copy_fragment(source.on_readable(static_cast<int>(index)), destination->add_on_readable())) {
      break;
    }
  }
}
 
}  // namespace

TelnetMockServer::TelnetMockServer() : scenario_(nullptr), socket_opened_(false) {}

TelnetMockServer::~TelnetMockServer() = default;

void TelnetMockServer::ConfigureRequestData(ScenarioRequestData* request_data) {
  if (request_data != nullptr) {
    request_data->SetBeforeUploadReadCallback(&DrainBeforeUploadRead, this);
  }
}

void TelnetMockServer::DrainBeforeUploadRead(void* userdata) {
  auto* server = static_cast<TelnetMockServer*>(userdata);
  if (server != nullptr && server->connection_) {
    (void)server->connection_->DrainIncoming();
  }
}

curl_socket_t TelnetMockServer::HandleOpenSocket(curlsocktype purpose, struct curl_sockaddr* address) {
  (void)purpose;
  (void)address;
  if (scenario_ == nullptr || socket_opened_) {
    return CURL_SOCKET_BAD;
  }
  socket_opened_ = true;
 
  connection_ = std::make_unique<MockConnection>();
  if (!connection_->ok()) {
    connection_.reset();
    return CURL_SOCKET_BAD;
  }
 
  if (!connection_->EnsureClientSendBufferSize(kMinClientSendBufferBytes)) {
    connection_.reset();
    return CURL_SOCKET_BAD;
  }
 
  const auto write_bytes = [this](const std::string& bytes) {
    return bytes.empty() || connection_->WriteAll(reinterpret_cast<const unsigned char*>(bytes.data()), bytes.size());
  };
 
  // Compatibility corpus entries bypass the LPM postprocessor. Copy only the
  // raw prefix TELNET can consume, then normalize it so direct replay gets the
  // same byte/control budgets without traversing HTTP/WS-only fields.
  const auto& source = scenario_->connection();
  curl::fuzzer::proto::Connection script;
  CopyTelnetResponsePrefix(source, &script);
  BoundTelnetResponse(&script);
  bool complete = write_bytes(script.initial_response());
  const std::size_t chunk_count = static_cast<std::size_t>(script.on_readable_size());
  for (std::size_t index = 0; complete && index < chunk_count; ++index) {
    complete = write_bytes(script.on_readable(static_cast<int>(index)));
  }
  (void)complete;
 
  // Do not apply BackpressureConfig here. curl's TELNET driver sends from
  // inside its blocking protocol loop; tightening the socket would invalidate
  // the minimum-capacity invariant used by the pre-read drain.
  connection_->ShutdownWrite();
  return connection_->take_client_fd();
}

void TelnetMockServer::RunLoop(CURLM* multi, CURL* easy, const curl::fuzzer::proto::Scenario& scenario) {
  (void)easy;
  scenario_ = &scenario;
  socket_opened_ = false;
  connection_.reset();
 
  int still_running = 1;
  for (int iteration = 0; still_running && iteration < kMaxIdleIterations; ++iteration) {
    const CURLMcode result = curl_multi_perform(multi, &still_running);
    if (result != CURLM_OK) {
      break;
    }
    if (connection_) {
      (void)connection_->DrainIncoming();
    }
  }
 
  scenario_ = nullptr;
}
 
}  // namespace proto_fuzzer