/*

 * Copyright (C) Max Dymond, <cmeister2@gmail.com>, et al.

 *

 * SPDX-License-Identifier: curl

 */

/// @file

/// @brief Implementation of the per-binary proto mutation policies.

#include "proto_fuzzer/target_policy.h"

#include <algorithm>

#include <cstdint>

#include <string>

#include "proto_fuzzer/scenario_limits.h"

namespace proto_fuzzer {

namespace {

// Linux raises smaller socket-buffer requests to an implementation minimum,

// so 2048 is both cheap and reliably small enough to exercise short writes.

constexpr std::uint32_t kDefaultBackpressureBufferBytes = 2048;

// Values outside these ranges do not create useful new socket behavior for

// the harness's bounded 4-16 KiB writes. Keeping them small also prevents a

// mutated uint32 recv size from overflowing the int accepted by setsockopt.

constexpr std::uint32_t kMinBackpressureBufferBytes = 2048;

constexpr std::uint32_t kMaxBackpressureBufferBytes = 4096;

constexpr std::uint32_t kMaxDrainBytesPerIteration = 1024;

/// Remove a repeated-field suffix that the runtime would ignore. Doing this

/// in LPM's postprocessor matters for speed as well as memory: otherwise later

/// mutations keep rediscovering and editing objects that cannot reach curl.

template <typename RepeatedField>

void TrimRepeated(RepeatedField* field, std::size_t limit) {

  const std::size_t size = static_cast<std::size_t>(field->size());

  if (size > limit) {

    field->DeleteSubrange(static_cast<int>(limit), static_cast<int>(size - limit));

  }

}

Unexecuted instantiation: target_policy.cc:void proto_fuzzer::(anonymous namespace)::TrimRepeated<google::protobuf::RepeatedPtrField<curl::fuzzer::proto::SetOption> >(google::protobuf::RepeatedPtrField<curl::fuzzer::proto::SetOption>*, unsigned long)

Unexecuted instantiation: target_policy.cc:void proto_fuzzer::(anonymous namespace)::TrimRepeated<google::protobuf::RepeatedPtrField<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > >(google::protobuf::RepeatedPtrField<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >*, unsigned long)

Unexecuted instantiation: target_policy.cc:void proto_fuzzer::(anonymous namespace)::TrimRepeated<google::protobuf::RepeatedPtrField<curl::fuzzer::proto::MimePart> >(google::protobuf::RepeatedPtrField<curl::fuzzer::proto::MimePart>*, unsigned long)

Unexecuted instantiation: target_policy.cc:void proto_fuzzer::(anonymous namespace)::TrimRepeated<google::protobuf::RepeatedPtrField<curl::fuzzer::proto::MimeDataPart> >(google::protobuf::RepeatedPtrField<curl::fuzzer::proto::MimeDataPart>*, unsigned long)

Unexecuted instantiation: target_policy.cc:void proto_fuzzer::(anonymous namespace)::TrimRepeated<google::protobuf::RepeatedPtrField<curl::fuzzer::proto::WebSocketFrame> >(google::protobuf::RepeatedPtrField<curl::fuzzer::proto::WebSocketFrame>*, unsigned long)

Unexecuted instantiation: target_policy.cc:void proto_fuzzer::(anonymous namespace)::TrimRepeated<google::protobuf::RepeatedPtrField<curl::fuzzer::proto::Connection> >(google::protobuf::RepeatedPtrField<curl::fuzzer::proto::Connection>*, unsigned long)

/// Bound strings passed to NUL-terminated metadata APIs. The runtime applies

/// the same prefix, so deleting the invisible suffix increases useful

/// mutation density without removing any behavior curl could observe.

void TrimMetadata(std::string* value) {

  if (value->size() > scenario_limits::kMaxMetadataBytes) {

    value->resize(scenario_limits::kMaxMetadataBytes);

  }

}

template <typename RepeatedBytes>

void BoundHeaderValues(RepeatedBytes* headers, std::size_t limit) {

  TrimRepeated(headers, limit);

  for (std::string& header : *headers) {

    TrimMetadata(&header);

  }

}

/// Keep one response script identical to the prefix MockServer and

/// WebSocketMockServer can deliver. Raw chunks take precedence over structured

/// frames, matching both runtime serializers.

void BoundConnectionShape(curl::fuzzer::proto::Connection* connection) {

  TrimRepeated(connection->mutable_on_readable(), scenario_limits::kMaxResponseChunks);

  const std::size_t raw_count = static_cast<std::size_t>(connection->on_readable_size());

  TrimRepeated(connection->mutable_server_frames(), scenario_limits::kMaxResponseChunks - raw_count);

}

/// Apply the metadata/header limits shared by both MIME part message types.

template <typename Part>

void BoundMimePartMetadata(Part* part) {

  TrimMetadata(part->mutable_name());

  TrimMetadata(part->mutable_filename());

  TrimMetadata(part->mutable_content_type());

  BoundHeaderValues(part->mutable_headers(), scenario_limits::kMaxMimeHeadersPerPart);

}

Unexecuted instantiation: target_policy.cc:void proto_fuzzer::(anonymous namespace)::BoundMimePartMetadata<curl::fuzzer::proto::MimePart>(curl::fuzzer::proto::MimePart*)

Unexecuted instantiation: target_policy.cc:void proto_fuzzer::(anonymous namespace)::BoundMimePartMetadata<curl::fuzzer::proto::MimeDataPart>(curl::fuzzer::proto::MimeDataPart*)

void BoundMimeLeaf(curl::fuzzer::proto::MimeDataPart* part) {

  BoundMimePartMetadata(part);

  if (part->data().size() > scenario_limits::kMaxMimeDataBytes) {

    part->mutable_data()->resize(scenario_limits::kMaxMimeDataBytes);

  }

}

/// Mirror the runtime's shared top-level/nested part budget in the protobuf

/// itself. A simple per-list cap is insufficient because many bounded child

/// lists could still leave most of the message semantically dead.

void BoundMimeShape(curl::fuzzer::proto::MimePost* post) {

  TrimRepeated(post->mutable_parts(), scenario_limits::kMaxTopLevelMimeParts);

  std::size_t remaining = scenario_limits::kMaxTotalMimeParts;

  std::size_t retained_top_parts = 0;

  while (retained_top_parts < static_cast<std::size_t>(post->parts_size()) && remaining != 0) {

    auto* part = post->mutable_parts(static_cast<int>(retained_top_parts));

    ++retained_top_parts;

    --remaining;

    BoundMimePartMetadata(part);

    if (part->content_case() == curl::fuzzer::proto::MimePart::kData) {

      if (part->data().size() > scenario_limits::kMaxMimeDataBytes) {

        part->mutable_data()->resize(scenario_limits::kMaxMimeDataBytes);

      }

      continue;

    }

    if (part->content_case() != curl::fuzzer::proto::MimePart::kSubparts) {

      continue;

    }

    auto* children = part->mutable_subparts()->mutable_parts();

    TrimRepeated(children, std::min(scenario_limits::kMaxNestedMimeParts, remaining));

    for (auto& child : *children) {

      BoundMimeLeaf(&child);

      --remaining;

    }

  }

  TrimRepeated(post->mutable_parts(), retained_top_parts);

}

/// Remove upload bytes and read steps the callback cannot observe. Clamping

/// individual limits also keeps mutations concentrated on short reads instead

/// of many distinct uint32 values that all collapse to the same 16 KiB cap.

void BoundUploadShape(curl::fuzzer::proto::UploadScript* upload) {

  if (upload->data().size() > scenario_limits::kMaxUploadBytes) {

    upload->mutable_data()->resize(scenario_limits::kMaxUploadBytes);

  }

  // RepeatedField<uint32_t> lacks RepeatedPtrField's DeleteSubrange helper;

  // removing the ignored suffix from the end is constant-time per element and

  // preserves the mutation-significant prefix exactly.

  while (static_cast<std::size_t>(upload->read_sizes_size()) > scenario_limits::kMaxUploadReadSteps) {

    upload->mutable_read_sizes()->RemoveLast();

  }

  for (int i = 0; i < upload->read_sizes_size(); ++i) {

    if (upload->read_sizes(i) > scenario_limits::kMaxUploadReadSize) {

      upload->set_read_sizes(i, scenario_limits::kMaxUploadReadSize);

    }

  }

}

/// Canonicalize all shape limits enforced by the runtime. This runs only in

/// fixed policy targets; the compatibility binary deliberately retains its

/// historical no-postprocessor semantics for existing OSS-Fuzz reproducers.

void BoundScenarioShape(curl::fuzzer::proto::Scenario* scenario) {

  TrimRepeated(scenario->mutable_options(), scenario_limits::kMaxOptions);

  for (auto& option : *scenario->mutable_options()) {

    if (option.value_case() == curl::fuzzer::proto::SetOption::kStringValue) {

      TrimMetadata(option.mutable_string_value());

    }

  }

  BoundHeaderValues(scenario->mutable_request_headers(), scenario_limits::kMaxRequestHeaders);

  if (scenario->has_mime_post()) {

    BoundMimeShape(scenario->mutable_mime_post());

  }

  if (scenario->has_upload()) {

    BoundUploadShape(scenario->mutable_upload());

  }

  BoundConnectionShape(scenario->mutable_connection());

  TrimRepeated(scenario->mutable_subsequent_connections(), scenario_limits::kMaxConnections - 1);

  for (auto& connection : *scenario->mutable_subsequent_connections()) {

    BoundConnectionShape(&connection);

  }

}

/// Return whether an option belongs in the high-throughput HTTP lane. This is

/// deliberately an allowlist rather than a denylist: adding a new structured

/// option should expand deep coverage first, not silently make the fast lane

/// slower before its cost has been measured.

bool IsCheapHttpOption(curl::fuzzer::proto::CurlOptionId option_id) {

  switch (option_id) {

    case curl::fuzzer::proto::CURLOPT_ACCEPT_ENCODING:

    case curl::fuzzer::proto::CURLOPT_BUFFERSIZE:

    case curl::fuzzer::proto::CURLOPT_CUSTOMREQUEST:

    case curl::fuzzer::proto::CURLOPT_DISALLOW_USERNAME_IN_URL:

    case curl::fuzzer::proto::CURLOPT_FAILONERROR:

    case curl::fuzzer::proto::CURLOPT_FILETIME:

    case curl::fuzzer::proto::CURLOPT_HEADER:

    case curl::fuzzer::proto::CURLOPT_HTTP09_ALLOWED:

    case curl::fuzzer::proto::CURLOPT_HTTP_CONTENT_DECODING:

    case curl::fuzzer::proto::CURLOPT_HTTP_TRANSFER_DECODING:

    case curl::fuzzer::proto::CURLOPT_HTTP_VERSION:

    case curl::fuzzer::proto::CURLOPT_HTTPGET:

    case curl::fuzzer::proto::CURLOPT_IGNORE_CONTENT_LENGTH:

    case curl::fuzzer::proto::CURLOPT_MAXFILESIZE_LARGE:

    case curl::fuzzer::proto::CURLOPT_NOBODY:

    case curl::fuzzer::proto::CURLOPT_PATH_AS_IS:

    case curl::fuzzer::proto::CURLOPT_RANGE:

    case curl::fuzzer::proto::CURLOPT_REQUEST_TARGET:

    case curl::fuzzer::proto::CURLOPT_RESUME_FROM_LARGE:

    case curl::fuzzer::proto::CURLOPT_TRANSFER_ENCODING:

    case curl::fuzzer::proto::CURLOPT_USERAGENT:

      return true;

    case curl::fuzzer::proto::CURL_OPTION_UNSPECIFIED:

    default:

      return false;

  }

}

/// Compact the option list before applying the general option-count bound.

/// Keeping an allowed option that appears after a long rejected prefix is

/// important for mutation density: bounding first would let expensive options

/// crowd cheap ones out of the only lane intended to approach legacy speed.

void RetainCheapHttpOptions(curl::fuzzer::proto::Scenario* scenario) {

  auto* options = scenario->mutable_options();

  int retained = 0;

  for (int index = 0; index < options->size(); ++index) {

    if (!IsCheapHttpOption(options->Get(index).option_id())) {

      continue;

    }

    if (retained != index) {

      options->SwapElements(retained, index);

    }

    ++retained;

  }

  options->DeleteSubrange(retained, options->size() - retained);

}

/// Remove the stateful shapes assigned to the deep HTTP target. This happens

/// before BoundScenarioShape so a fast iteration never walks or normalizes a

/// MIME tree, upload script, or follow-on connection that it will discard.

/// Raw response chunks and request headers stay intact because they reach the

/// core HTTP parser cheaply and provide much of the legacy fuzzer's coverage.

void RemoveDeepHttpShape(curl::fuzzer::proto::Scenario* scenario) {

  scenario->clear_mime_post();

  scenario->clear_upload();

  scenario->clear_subsequent_connections();

  auto* connection = scenario->mutable_connection();

  connection->clear_server_frames();

  connection->clear_manual_probes();

  connection->clear_backpressure();

}

/// Remove fields the single-socket WebSocket driver cannot consume. MIME also

/// changes the HTTP request away from a useful Upgrade handshake, so retaining

/// either shape in fixed WS lanes gives LPM mutation work with no WS coverage

/// payoff. The mixed compatibility target has no postprocessor and keeps its

/// historical behavior.

void RemoveIgnoredWebSocketShape(curl::fuzzer::proto::Scenario* scenario) {

  scenario->clear_subsequent_connections();

  scenario->clear_mime_post();

}

/// Preserve useful in-range mutations while folding ineffective extremes onto

/// meaningful boundaries. Zero remains special: it disables that individual

/// control and lets the other control provide the timing target's pressure.

std::uint32_t CanonicalizeNonZero(std::uint32_t value, std::uint32_t minimum, std::uint32_t maximum) {

  if (value == 0) {

    return 0;

  }

  return std::max(minimum, std::min(value, maximum));

}

/// Keep the timing target on the plaintext member of the protocol family.

/// TLS setup has its own cost profile and would obscure whether backpressure

/// mutations are exploring curl's send/receive state machines effectively.

curl::fuzzer::proto::Scheme PlaintextScheme(curl::fuzzer::proto::Scheme scheme) {

  switch (scheme) {

    case curl::fuzzer::proto::SCHEME_WS:

    case curl::fuzzer::proto::SCHEME_WSS:

      return curl::fuzzer::proto::SCHEME_WS;

    case curl::fuzzer::proto::SCHEME_HTTP:

    case curl::fuzzer::proto::SCHEME_HTTPS:

    case curl::fuzzer::proto::SCHEME_UNSPECIFIED:

    default:

      return curl::fuzzer::proto::SCHEME_HTTP;

  }

}

/// Remove timing controls from every connection the structured message can

/// carry. Clearing only the primary script would let a mutated redirect turn a

/// fixed fast lane into the timed drive loop after its second socket opens.

void ClearAllBackpressure(curl::fuzzer::proto::Scenario* scenario) {

  if (scenario->has_connection()) {

    scenario->mutable_connection()->clear_backpressure();

  }

  for (auto& connection : *scenario->mutable_subsequent_connections()) {

    connection.clear_backpressure();

  }

}

/// Clamp one explicitly pressure-bearing follow-on script to the same useful

/// ranges as the timing lane's primary connection. An absent configuration is

/// left absent so merely adding a redirect response does not add waits.

void CanonicalizeOptionalBackpressure(curl::fuzzer::proto::Connection* connection) {

  if (!connection->has_backpressure()) {

    return;

  }

  auto* backpressure = connection->mutable_backpressure();

  if (backpressure->recv_buf_bytes() == 0 && backpressure->drain_limit() != 0) {

    backpressure->set_recv_buf_bytes(kDefaultBackpressureBufferBytes);

  } else {

    backpressure->set_recv_buf_bytes(

        CanonicalizeNonZero(backpressure->recv_buf_bytes(), kMinBackpressureBufferBytes, kMaxBackpressureBufferBytes));

  }

  backpressure->set_drain_limit(CanonicalizeNonZero(backpressure->drain_limit(), 1, kMaxDrainBytesPerIteration));

}

}  // namespace

/// Canonicalize the fields that determine which server and drive-loop policy

/// execute. Fast targets discard backpressure because one mutated non-zero

/// scalar otherwise opts an ordinary input into hundreds of timed waits. The

/// timing target does the inverse: it guarantees a non-default buffer setting

/// so its CPU allocation remains focused on the intentionally slower paths.

void ApplyTargetPolicy(curl::fuzzer::proto::Scenario* scenario, TargetPolicy policy) {

  if (scenario == nullptr) {

    return;

  }

  if (policy == TargetPolicy::kFastHttp) {

    scenario->set_scheme(curl::fuzzer::proto::SCHEME_HTTP);

    RemoveDeepHttpShape(scenario);

    RetainCheapHttpOptions(scenario);

    BoundScenarioShape(scenario);

    return;

  }

  BoundScenarioShape(scenario);

  switch (policy) {

    case TargetPolicy::kFastHttp:

      // Handled before the general bounds so discarded deep shapes are never

      // traversed on the fast path.

      return;

    case TargetPolicy::kDeepHttp:

      scenario->set_scheme(curl::fuzzer::proto::SCHEME_HTTP);

      ClearAllBackpressure(scenario);

      return;

    case TargetPolicy::kFastHttps:

      scenario->set_scheme(curl::fuzzer::proto::SCHEME_HTTPS);

      ClearAllBackpressure(scenario);

      return;

    case TargetPolicy::kFastWebSocket:

      scenario->set_scheme(curl::fuzzer::proto::SCHEME_WS);

      ClearAllBackpressure(scenario);

      RemoveIgnoredWebSocketShape(scenario);

      return;

    case TargetPolicy::kFastSecureWebSocket:

      scenario->set_scheme(curl::fuzzer::proto::SCHEME_WSS);

      ClearAllBackpressure(scenario);

      RemoveIgnoredWebSocketShape(scenario);

      return;

    case TargetPolicy::kTiming: {

      scenario->set_scheme(PlaintextScheme(scenario->scheme()));

      if (scenario->scheme() == curl::fuzzer::proto::SCHEME_WS) {

        RemoveIgnoredWebSocketShape(scenario);

      }

      auto* backpressure = scenario->mutable_connection()->mutable_backpressure();

      if (backpressure->recv_buf_bytes() == 0) {

        // A drain limit alone cannot fill the default AF_UNIX buffer with the

        // harness's bounded upload. Always tighten the socket so this lane

        // represents real pressure, not merely selection of the timed loop.

        backpressure->set_recv_buf_bytes(kDefaultBackpressureBufferBytes);

      } else {

        backpressure->set_recv_buf_bytes(CanonicalizeNonZero(backpressure->recv_buf_bytes(),

                                                             kMinBackpressureBufferBytes, kMaxBackpressureBufferBytes));

      }

      backpressure->set_drain_limit(CanonicalizeNonZero(backpressure->drain_limit(), 1, kMaxDrainBytesPerIteration));

      for (auto& connection : *scenario->mutable_subsequent_connections()) {

        CanonicalizeOptionalBackpressure(&connection);

      }

      return;

    }

  }

}

}  // namespace proto_fuzzer