/src/curl_fuzzer/proto_fuzzer/target_profile.h

Source
/*
 * Copyright (C) Max Dymond, <cmeister2@gmail.com>, et al.
 *
 * SPDX-License-Identifier: curl
 */

/// @file
/// @brief Compile-time identities and execution modes for proto fuzz targets.

#ifndef PROTO_FUZZER_TARGET_PROFILE_H_
#define PROTO_FUZZER_TARGET_PROFILE_H_

namespace proto_fuzzer {

/// Identifies one compiled proto-fuzzer lane. A profile is the single source
/// of truth for both mutation constraints and runtime coverage policy, which
/// prevents independent flags from describing combinations no target uses.
enum class TargetProfile {
  /// Preserve the original mixed target and its accumulated corpus exactly.
  kCompatibility,
  /// Keep ordinary HTTP iterations competitive with the legacy byte fuzzers.
  kFastHttp,
  /// Retain HTTP's complete structured request and response surface.
  kDeepHttp,
  /// Exercise a complete HTTPS exchange against the in-process TLS peer.
  kFastHttps,
  /// Exercise raw HTTP/2 origin frames after a verified TLS/ALPN handshake.
  kHttpsH2,
  /// Exercise HTTP/2 origin frames over plaintext prior knowledge.
  kFastHttp2,
  /// Exercise HTTP/3 over a valid in-process QUIC/TLS connection.
  kFastHttp3,
  /// Exercise an HTTP/1.1 origin through an HTTPS/HTTP2 CONNECT proxy.
  kH2Proxy,
  /// Exercise HTTP through an in-process SOCKS4/SOCKS4A proxy.
  kSocks4,
  /// Exercise localhost lookup and structured CURLOPT_RESOLVE host-cache work.
  kResolver,
  /// Exercise plaintext WebSocket framing without wall-clock waits.
  kFastWebSocket,
  /// Exercise WebSocket framing through a verified TLS connection.
  kFastSecureWebSocket,
  /// Exercise bounded TELNET negotiation and callback-backed input.
  kFastTelnet,
  /// Exercise FTP control and passive data connections without external I/O.
  kFastFtp,
  /// Exercise packet-preserving TFTP exchanges over the loopback UDP peer.
  kFastTftp,
  /// Exercise Gopher selectors through the bounded stream peer.
  kFastGopher,
  /// Exercise easy, share, multi, URL, and result API lifecycles.
  kApi,
  /// Exercise several easy handles through one shared multi handle.
  kMulti,
  /// Isolate deterministic backpressure and timed-wait behavior.
  kTiming,
};

/// Selects one of the complete, valid RunScenario behaviours. Keeping this
/// closed set avoids boolean combinations that have no useful interpretation.
enum class ScenarioRunMode {
  /// Drive the protocol without charging its hot loop for generic API probes.
  kFastProtocol,
  /// Drive the protocol and inspect a compact set of public result APIs.
  kProtocolCoverage,
  /// Drive deep HTTP plus its bounded filename-backed parser inputs.
  kDeepHttpCoverage,
  /// Drive HTTPS through a real TLS peer and inspect live TLS result state.
  kTlsCoverage,
  /// Drive WebSocket framing through a verified in-process TLS peer.
  kTlsWebSocketCoverage,
  /// Drive an HTTPS origin through fixed ALPN h2 with push/upkeep probes.
  kTlsHttp2Coverage,
  /// Drive a plaintext HTTP/2 prior-knowledge origin with the H2 peer.
  kHttp2Coverage,
  /// Drive ordered plaintext HTTP/3 actions through the QUIC peer.
  kHttp3Coverage,
  /// Drive raw HTTP/2 proxy frames around one CONNECT tunnel.
  kH2ProxyCoverage,
  /// Drive a request-triggered SOCKS4 reply followed by tunneled HTTP.
  kSocks4Coverage,
  /// Let curl resolve the origin while the socket callback still owns I/O.
  kResolverCoverage,
  /// Drive FTP through its concurrent control/passive-data peer.
  kFtpCoverage,
  /// Drive TFTP through its datagram-preserving loopback peer.
  kTftpCoverage,
  /// Drive Gopher through the bounded stream peer.
  kGopherCoverage,
  /// Honour ApiPlan and run the dedicated lifecycle and typed-result probes.
  kApiLifecycle,
  /// Honour MultiPlan and drive several HTTP transfers through one multi.
  kMultiTransfer,
};

/// Derive runtime behaviour from the compiled target identity. Mutation policy
/// remains profile-specific, while targets that need the same execution cost
/// deliberately share a run mode.
/// @param profile Compiled target whose runner behaviour is required.
/// @return The only RunScenario mode valid for that target.
constexpr ScenarioRunMode RunModeFor(TargetProfile profile) {
  switch (profile) {
    case TargetProfile::kFastHttp:
    case TargetProfile::kFastTelnet:
      return ScenarioRunMode::kFastProtocol;

    case TargetProfile::kApi:
      return ScenarioRunMode::kApiLifecycle;

    case TargetProfile::kMulti:
      return ScenarioRunMode::kMultiTransfer;

    case TargetProfile::kFastHttps:
      return ScenarioRunMode::kTlsCoverage;

    case TargetProfile::kFastSecureWebSocket:
      return ScenarioRunMode::kTlsWebSocketCoverage;

    case TargetProfile::kHttpsH2:
      return ScenarioRunMode::kTlsHttp2Coverage;

    case TargetProfile::kFastHttp2:
      return ScenarioRunMode::kHttp2Coverage;

    case TargetProfile::kFastHttp3:
      return ScenarioRunMode::kHttp3Coverage;

    case TargetProfile::kH2Proxy:
      return ScenarioRunMode::kH2ProxyCoverage;

    case TargetProfile::kSocks4:
      return ScenarioRunMode::kSocks4Coverage;

    case TargetProfile::kResolver:
      return ScenarioRunMode::kResolverCoverage;

    case TargetProfile::kFastFtp:
      return ScenarioRunMode::kFtpCoverage;

    case TargetProfile::kFastTftp:
      return ScenarioRunMode::kTftpCoverage;

    case TargetProfile::kFastGopher:
      return ScenarioRunMode::kGopherCoverage;

    case TargetProfile::kCompatibility:
    case TargetProfile::kFastWebSocket:
    case TargetProfile::kTiming:
      return ScenarioRunMode::kProtocolCoverage;

    case TargetProfile::kDeepHttp:
      return ScenarioRunMode::kDeepHttpCoverage;
  }
  return ScenarioRunMode::kProtocolCoverage;
}

}  // namespace proto_fuzzer

#endif  // PROTO_FUZZER_TARGET_PROFILE_H_

Line	Count	Source
1		/*
2		* Copyright (C) Max Dymond, <cmeister2@gmail.com>, et al.
3		*
4		* SPDX-License-Identifier: curl
5		*/
6
7		/// @file
8		/// @brief Compile-time identities and execution modes for proto fuzz targets.
9
10		#ifndef PROTO_FUZZER_TARGET_PROFILE_H_
11		#define PROTO_FUZZER_TARGET_PROFILE_H_
12
13		namespace proto_fuzzer {
14
15		/// Identifies one compiled proto-fuzzer lane. A profile is the single source
16		/// of truth for both mutation constraints and runtime coverage policy, which
17		/// prevents independent flags from describing combinations no target uses.
18		enum class TargetProfile {
19		/// Preserve the original mixed target and its accumulated corpus exactly.
20		kCompatibility,
21		/// Keep ordinary HTTP iterations competitive with the legacy byte fuzzers.
22		kFastHttp,
23		/// Retain HTTP's complete structured request and response surface.
24		kDeepHttp,
25		/// Exercise a complete HTTPS exchange against the in-process TLS peer.
26		kFastHttps,
27		/// Exercise raw HTTP/2 origin frames after a verified TLS/ALPN handshake.
28		kHttpsH2,
29		/// Exercise HTTP/2 origin frames over plaintext prior knowledge.
30		kFastHttp2,
31		/// Exercise HTTP/3 over a valid in-process QUIC/TLS connection.
32		kFastHttp3,
33		/// Exercise an HTTP/1.1 origin through an HTTPS/HTTP2 CONNECT proxy.
34		kH2Proxy,
35		/// Exercise HTTP through an in-process SOCKS4/SOCKS4A proxy.
36		kSocks4,
37		/// Exercise localhost lookup and structured CURLOPT_RESOLVE host-cache work.
38		kResolver,
39		/// Exercise plaintext WebSocket framing without wall-clock waits.
40		kFastWebSocket,
41		/// Exercise WebSocket framing through a verified TLS connection.
42		kFastSecureWebSocket,
43		/// Exercise bounded TELNET negotiation and callback-backed input.
44		kFastTelnet,
45		/// Exercise FTP control and passive data connections without external I/O.
46		kFastFtp,
47		/// Exercise packet-preserving TFTP exchanges over the loopback UDP peer.
48		kFastTftp,
49		/// Exercise Gopher selectors through the bounded stream peer.
50		kFastGopher,
51		/// Exercise easy, share, multi, URL, and result API lifecycles.
52		kApi,
53		/// Exercise several easy handles through one shared multi handle.
54		kMulti,
55		/// Isolate deterministic backpressure and timed-wait behavior.
56		kTiming,
57		};
58
59		/// Selects one of the complete, valid RunScenario behaviours. Keeping this
60		/// closed set avoids boolean combinations that have no useful interpretation.
61		enum class ScenarioRunMode {
62		/// Drive the protocol without charging its hot loop for generic API probes.
63		kFastProtocol,
64		/// Drive the protocol and inspect a compact set of public result APIs.
65		kProtocolCoverage,
66		/// Drive deep HTTP plus its bounded filename-backed parser inputs.
67		kDeepHttpCoverage,
68		/// Drive HTTPS through a real TLS peer and inspect live TLS result state.
69		kTlsCoverage,
70		/// Drive WebSocket framing through a verified in-process TLS peer.
71		kTlsWebSocketCoverage,
72		/// Drive an HTTPS origin through fixed ALPN h2 with push/upkeep probes.
73		kTlsHttp2Coverage,
74		/// Drive a plaintext HTTP/2 prior-knowledge origin with the H2 peer.
75		kHttp2Coverage,
76		/// Drive ordered plaintext HTTP/3 actions through the QUIC peer.
77		kHttp3Coverage,
78		/// Drive raw HTTP/2 proxy frames around one CONNECT tunnel.
79		kH2ProxyCoverage,
80		/// Drive a request-triggered SOCKS4 reply followed by tunneled HTTP.
81		kSocks4Coverage,
82		/// Let curl resolve the origin while the socket callback still owns I/O.
83		kResolverCoverage,
84		/// Drive FTP through its concurrent control/passive-data peer.
85		kFtpCoverage,
86		/// Drive TFTP through its datagram-preserving loopback peer.
87		kTftpCoverage,
88		/// Drive Gopher through the bounded stream peer.
89		kGopherCoverage,
90		/// Honour ApiPlan and run the dedicated lifecycle and typed-result probes.
91		kApiLifecycle,
92		/// Honour MultiPlan and drive several HTTP transfers through one multi.
93		kMultiTransfer,
94		};
95
96		/// Derive runtime behaviour from the compiled target identity. Mutation policy
97		/// remains profile-specific, while targets that need the same execution cost
98		/// deliberately share a run mode.
99		/// @param profile Compiled target whose runner behaviour is required.
100		/// @return The only RunScenario mode valid for that target.
101	350k	constexpr ScenarioRunMode RunModeFor(TargetProfile profile) {
102	350k	switch (profile) {
103	19.0k	case TargetProfile::kFastHttp:
104	23.7k	case TargetProfile::kFastTelnet:
105	23.7k	return ScenarioRunMode::kFastProtocol;
106
107	24.2k	case TargetProfile::kApi:
108	24.2k	return ScenarioRunMode::kApiLifecycle;
109
110	22.7k	case TargetProfile::kMulti:
111	22.7k	return ScenarioRunMode::kMultiTransfer;
112
113	63.2k	case TargetProfile::kFastHttps:
114	63.2k	return ScenarioRunMode::kTlsCoverage;
115
116	11.6k	case TargetProfile::kFastSecureWebSocket:
117	11.6k	return ScenarioRunMode::kTlsWebSocketCoverage;
118
119	16.5k	case TargetProfile::kHttpsH2:
120	16.5k	return ScenarioRunMode::kTlsHttp2Coverage;
121
122	19.6k	case TargetProfile::kFastHttp2:
123	19.6k	return ScenarioRunMode::kHttp2Coverage;
124
125	10.3k	case TargetProfile::kFastHttp3:
126	10.3k	return ScenarioRunMode::kHttp3Coverage;
127
128	13.0k	case TargetProfile::kH2Proxy:
129	13.0k	return ScenarioRunMode::kH2ProxyCoverage;
130
131	16.9k	case TargetProfile::kSocks4:
132	16.9k	return ScenarioRunMode::kSocks4Coverage;
133
134	15.1k	case TargetProfile::kResolver:
135	15.1k	return ScenarioRunMode::kResolverCoverage;
136
137	8.90k	case TargetProfile::kFastFtp:
138	8.90k	return ScenarioRunMode::kFtpCoverage;
139
140	2.50k	case TargetProfile::kFastTftp:
141	2.50k	return ScenarioRunMode::kTftpCoverage;
142
143	10.1k	case TargetProfile::kFastGopher:
144	10.1k	return ScenarioRunMode::kGopherCoverage;
145
146	28.4k	case TargetProfile::kCompatibility:
147	41.8k	case TargetProfile::kFastWebSocket:
148	61.6k	case TargetProfile::kTiming:
149	61.6k	return ScenarioRunMode::kProtocolCoverage;
150
151	30.4k	case TargetProfile::kDeepHttp:
152	30.4k	return ScenarioRunMode::kDeepHttpCoverage;
153	350k	}
154	0	return ScenarioRunMode::kProtocolCoverage;
155	350k	}
156
157		} // namespace proto_fuzzer
158
159		#endif // PROTO_FUZZER_TARGET_PROFILE_H_

Coverage Report

Created: 2026-10-15 06:25