tftp_mock_server.cc

Go to the documentation of this file.

/*
 * Copyright (C) Max Dymond, <cmeister2@gmail.com>, et al.
 *
 * SPDX-License-Identifier: curl
 */

 
#include "proto_fuzzer/tftp_mock_server.h"
 
#include <fcntl.h>
#include <sys/socket.h>
#include <unistd.h>
 
#include <algorithm>
#include <array>
#include <cerrno>
#include <cstring>
#include <utility>
 
namespace proto_fuzzer {

TftpMockServer::TftpMockServer()
    : response_datagrams_(),
      response_datagram_count_(0),
      next_response_datagram_(0),
      request_fd_(-1),
      transfer_fd_(-1),
      client_address_(),
      client_address_length_(0),
      has_client_address_(false),
      socket_opened_(false),
      request_port_(0),
      transfer_port_(0),
      received_datagrams_() {}

TftpMockServer::~TftpMockServer() { ResetPeer(); }

const std::vector<TftpReceivedDatagram>& TftpMockServer::received_datagrams() const { return received_datagrams_; }

std::uint16_t TftpMockServer::request_port() const { return request_port_; }

std::uint16_t TftpMockServer::transfer_port() const { return transfer_port_; }

SocketSetupDisposition TftpMockServer::GetSocketSetupDisposition(curl_socket_t /*curlfd*/,
                                                                 curlsocktype /*purpose*/) const {
  return SocketSetupDisposition::kNeedsSetup;
}

void TftpMockServer::PrepareScript(const curl::fuzzer::proto::Connection& connection) {
  response_datagrams_.fill(nullptr);
  response_datagram_count_ = 0;
  next_response_datagram_ = 0;
 
  if (!connection.initial_response().empty()) {
    response_datagrams_[response_datagram_count_++] = &connection.initial_response();
  }
  const std::size_t chunk_count =
      std::min<std::size_t>(scenario_limits::kMaxResponseChunks, connection.on_readable_size());
  for (std::size_t index = 0; index < chunk_count; ++index) {
    response_datagrams_[response_datagram_count_++] = &connection.on_readable(static_cast<int>(index));
  }
}

void TftpMockServer::ResetPeer() {
  if (request_fd_ >= 0) {
    (void)::close(request_fd_);
    request_fd_ = -1;
  }
  if (transfer_fd_ >= 0) {
    (void)::close(transfer_fd_);
    transfer_fd_ = -1;
  }
  std::memset(&client_address_, 0, sizeof(client_address_));
  client_address_length_ = 0;
  has_client_address_ = false;
  socket_opened_ = false;
  request_port_ = 0;
  transfer_port_ = 0;
}

bool TftpMockServer::ConfigureSocket(int fd) {
  if (fd < 0) {
    return false;
  }
  const int descriptor_flags = ::fcntl(fd, F_GETFD, 0);
  if (descriptor_flags < 0 || ::fcntl(fd, F_SETFD, descriptor_flags | FD_CLOEXEC) < 0) {
    return false;
  }
  const int status_flags = ::fcntl(fd, F_GETFL, 0);
  return status_flags >= 0 && ::fcntl(fd, F_SETFL, status_flags | O_NONBLOCK) == 0;
}

int TftpMockServer::OpenLoopbackSocket(struct sockaddr_in* bound_address) {
  if (bound_address == nullptr) {
    return -1;
  }
  const int fd = ::socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
  if (fd < 0 || !ConfigureSocket(fd)) {
    if (fd >= 0) {
      (void)::close(fd);
    }
    return -1;
  }
 
  struct sockaddr_in requested = {};
  requested.sin_family = AF_INET;
  requested.sin_port = htons(0);
  requested.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
  if (::bind(fd, reinterpret_cast<const struct sockaddr*>(&requested), sizeof(requested)) != 0) {
    (void)::close(fd);
    return -1;
  }
 
  socklen_t length = sizeof(*bound_address);
  std::memset(bound_address, 0, sizeof(*bound_address));
  if (::getsockname(fd, reinterpret_cast<struct sockaddr*>(bound_address), &length) != 0 ||
      length != sizeof(*bound_address) || bound_address->sin_family != AF_INET) {
    (void)::close(fd);
    return -1;
  }
  return fd;
}

bool TftpMockServer::RewriteDestination(struct curl_sockaddr* address, const struct sockaddr_in& destination) {
  if (address == nullptr || sizeof(destination) > sizeof(address->addr)) {
    return false;
  }
  address->family = AF_INET;
  address->socktype = SOCK_DGRAM;
  address->protocol = IPPROTO_UDP;
  address->addrlen = sizeof(destination);
  std::memset(&address->addr, 0, sizeof(address->addr));
  std::memcpy(&address->addr, &destination, sizeof(destination));
  return true;
}

curl_socket_t TftpMockServer::HandleOpenSocket(curlsocktype purpose, struct curl_sockaddr* address) {
  if (purpose != CURLSOCKTYPE_IPCXN || address == nullptr || socket_opened_) {
    return CURL_SOCKET_BAD;
  }
  socket_opened_ = true;
 
  struct sockaddr_in request_address = {};
  struct sockaddr_in transfer_address = {};
  request_fd_ = OpenLoopbackSocket(&request_address);
  transfer_fd_ = OpenLoopbackSocket(&transfer_address);
  if (request_fd_ < 0 || transfer_fd_ < 0 || !RewriteDestination(address, request_address)) {
    ResetPeer();
    return CURL_SOCKET_BAD;
  }
 
  request_port_ = ntohs(request_address.sin_port);
  transfer_port_ = ntohs(transfer_address.sin_port);
 
  const int client_fd = ::socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
  if (client_fd < 0 || !ConfigureSocket(client_fd)) {
    if (client_fd >= 0) {
      (void)::close(client_fd);
    }
    ResetPeer();
    return CURL_SOCKET_BAD;
  }
  return static_cast<curl_socket_t>(client_fd);
}

void TftpMockServer::RememberClientAddress(const struct sockaddr_in& address, socklen_t length) {
  if (has_client_address_ || length != sizeof(address) || address.sin_family != AF_INET) {
    return;
  }
  client_address_ = address;
  client_address_length_ = length;
  has_client_address_ = true;
}

std::size_t TftpMockServer::DrainSocket(int fd, TftpSocketRole role) {
  if (fd < 0) {
    return 0;
  }
 
  std::array<unsigned char, 65536> packet;
  std::size_t count = 0;
  while (true) {
    struct sockaddr_in source = {};
    socklen_t source_length = sizeof(source);
    const ssize_t received =
        ::recvfrom(fd, packet.data(), packet.size(), 0, reinterpret_cast<struct sockaddr*>(&source), &source_length);
    if (received < 0) {
      if (errno == EINTR) {
        continue;
      }
      break;
    }
 
    ++count;
    RememberClientAddress(source, source_length);
    if (received_datagrams_.size() < kMaxCapturedDatagrams) {
      TftpReceivedDatagram observation;
      observation.received_on = role;
      observation.source_port =
          source_length == sizeof(source) && source.sin_family == AF_INET ? ntohs(source.sin_port) : 0;
      observation.bytes.assign(reinterpret_cast<const char*>(packet.data()), static_cast<std::size_t>(received));
      received_datagrams_.push_back(std::move(observation));
    }
  }
  return count;
}

std::size_t TftpMockServer::DrainClientDatagrams() {
  return DrainSocket(request_fd_, TftpSocketRole::kRequest) + DrainSocket(transfer_fd_, TftpSocketRole::kTransfer);
}

bool TftpMockServer::SendNextDatagram() {
  if (!has_client_address_ || transfer_fd_ < 0 || next_response_datagram_ >= response_datagram_count_) {
    return false;
  }
 
  const std::string& datagram = *response_datagrams_[next_response_datagram_++];
  (void)::sendto(transfer_fd_, datagram.data(), datagram.size(), 0,
                 reinterpret_cast<const struct sockaddr*>(&client_address_), client_address_length_);
  return true;
}

void TftpMockServer::RunLoop(CURLM* multi, CURL* easy, const curl::fuzzer::proto::Scenario& scenario) {
  (void)easy;
  ResetPeer();
  PrepareScript(scenario.connection());
  received_datagrams_.clear();
  received_datagrams_.reserve(kMaxCapturedDatagrams);
 
  int still_running = 1;
  int idle_iterations = 0;
  for (int iteration = 0; iteration < kMaxDriveIterations; ++iteration) {
    const CURLMcode result = curl_multi_perform(multi, &still_running);
    if (result != CURLM_OK) {
      break;
    }
 
    const bool received = DrainClientDatagrams() != 0;
    const bool sent = still_running != 0 && received && SendNextDatagram();
    if (received || sent) {
      idle_iterations = 0;
    } else {
      ++idle_iterations;
    }
 
    if (still_running == 0 || idle_iterations >= kMaxIdleIterations) {
      break;
    }
  }
}

void TftpMockServer::ObserveState() {
#if defined(PROTO_FUZZER_OBSERVE_STATE)
  MockServerBase::ObserveState();
  const volatile std::size_t tftp_observation[] = {received_datagrams().size(), request_port(), transfer_port()};
  (void)tftp_observation;
#endif
}
 
}  // namespace proto_fuzzer