/src/curl_fuzzer/proto_fuzzer/ldap_mock_server.cc

Source
/*
 * Copyright (C) Max Dymond, <cmeister2@gmail.com>, et al.
 *
 * SPDX-License-Identifier: curl
 */

/// @file
/// @brief Implementation of the BER/ASN.1-aware in-process LDAP peer.

#include "proto_fuzzer/ldap_mock_server.h"

#include <algorithm>
#include <cstddef>
#include <cstdint>
#include <limits>
#include <memory>
#include <string>
#include <string_view>

#include "proto_fuzzer/mock_server.h"
#include "proto_fuzzer/scenario_limits.h"

namespace proto_fuzzer {

namespace {

// RFC 4511 protocol operation tags used by this peer.
constexpr unsigned char kSequenceTag = 0x30;
constexpr unsigned char kBooleanTag = 0x01;
constexpr unsigned char kIntegerTag = 0x02;
constexpr unsigned char kEnumeratedTag = 0x0a;
constexpr unsigned char kOctetStringTag = 0x04;
constexpr unsigned char kUnbindRequest = 0x42;
constexpr unsigned char kBindRequest = 0x60;
constexpr unsigned char kBindResponse = 0x61;
constexpr unsigned char kSearchRequest = 0x63;
constexpr unsigned char kSearchResultEntry = 0x64;
constexpr unsigned char kSearchResultDone = 0x65;
constexpr unsigned char kAbandonRequest = 0x50;
constexpr unsigned char kExtendedRequest = 0x77;
constexpr unsigned char kExtendedResponse = 0x78;
constexpr unsigned char kSetTag = 0x31;
constexpr unsigned char kPresentFilter = 0x87;
constexpr int kLdapSuccess = 0;
constexpr std::string_view kObjectClass = "objectclass";
constexpr std::string_view kSupportedSaslMechanisms = "supportedSASLMechanisms";
constexpr std::string_view kPlainMechanism = "PLAIN";

unsigned char ByteAt(std::string_view bytes, std::size_t index) { return static_cast<unsigned char>(bytes[index]); }

}  // namespace

/// Begin without a borrowed protobuf or open socketpair. RunLoop borrows a
/// Scenario only for the synchronous DriveScenario call in which socket
/// callbacks can run.
LdapMockServer::LdapMockServer()
    : scenario_(nullptr),
      server_chunk_count_(0),
      next_server_chunk_(0),
      bind_request_count_(0),
      search_request_count_(0),
      mechanism_search_request_count_(0),
      starttls_request_count_(0),
      unbind_request_count_(0),
      server_message_count_(0),
      scripted_message_count_(0),
      synthesized_done_count_(0),
      scripted_bind_response_count_(0),
      search_message_id_(0),
      search_active_(false),
      search_done_sent_(false),
      scripted_bind_consumed_(false),
      release_script_chunks_(false),
      peer_closed_(false),
      protocol_error_(false),
      socket_opened_(false) {}

/// Release the server-owned socketpair half after curl has returned its client
/// descriptor. The out-of-line destructor keeps MockConnection's complete type
/// local to this translation unit.
LdapMockServer::~LdapMockServer() = default;

/// @return A prefix of complete client LDAPMessages from the most recent drive.
const std::string& LdapMockServer::packet_transcript() const { return packet_transcript_; }

/// Append one fragment after the transport has decoded it. Plaintext peers
/// report socket bytes directly; the LDAPS peer reports decrypted application
/// bytes, so the BER parser is independent of the carrier.
/// @param data First byte of the fragment.
/// @param size Number of bytes available at `data`.
void LdapMockServer::ObserveIncomingData(const unsigned char* data, std::size_t size) {
  if (data == nullptr || size == 0) {
    return;
  }
  pending_client_bytes_.append(reinterpret_cast<const char*>(data), size);
}

/// @return Number of bindRequest messages observed.
std::size_t LdapMockServer::bind_request_count() const { return bind_request_count_; }

/// @return Number of searchRequest messages observed.
std::size_t LdapMockServer::search_request_count() const { return search_request_count_; }

/// @return Number of root-DSE supportedSASLMechanisms searches observed.
std::size_t LdapMockServer::mechanism_search_request_count() const { return mechanism_search_request_count_; }

/// @return Number of StartTLS ExtendedRequest messages observed.
std::size_t LdapMockServer::starttls_request_count() const { return starttls_request_count_; }

/// @return Number of unbindRequest messages observed.
std::size_t LdapMockServer::unbind_request_count() const { return unbind_request_count_; }

/// @return Number of server messages written in the most recent drive.
std::size_t LdapMockServer::server_message_count() const { return server_message_count_; }

/// @return Number of scripted search-result chunks forwarded.
std::size_t LdapMockServer::scripted_message_count() const { return scripted_message_count_; }

/// @return Number of searchResDone messages generated by the peer.
std::size_t LdapMockServer::synthesized_done_count() const { return synthesized_done_count_; }

/// @return Number of bind replies taken from initial_response.
std::size_t LdapMockServer::scripted_bind_response_count() const { return scripted_bind_response_count_; }

/// Decode one definite-length BER TLV. The decoder accepts a single short-form
/// length byte or long form with at most four length bytes; indefinite lengths
/// and lengths beyond the peer's message budget are protocol errors. A
/// truncated header or body reports kNeedMore so the caller can retain the
/// partial bytes for the next socket read.
/// @param bytes Buffer beginning at the TLV start.
/// @param offset Offset of the tag byte within `bytes`.
/// @param view Receives the decoded tag and bounded value extent.
/// @return kComplete, kNeedMore, or kInvalid.
LdapMockServer::ParseResult LdapMockServer::ParseTlv(std::string_view bytes, std::size_t offset, TlvView* view) {
  if (view == nullptr) {
    return ParseResult::kInvalid;
  }
  if (offset >= bytes.size()) {
    return ParseResult::kNeedMore;
  }

  const unsigned char tag = ByteAt(bytes, offset);
  if (tag == 0) {
    // End-of-contents is only valid for indefinite lengths, which LDAP forbids
    // in the commands this peer accepts.
    return ParseResult::kInvalid;
  }

  std::size_t cursor = offset + 1;
  if (cursor >= bytes.size()) {
    return ParseResult::kNeedMore;
  }

  const unsigned char length_byte = ByteAt(bytes, cursor++);
  std::size_t length = 0;
  if ((length_byte & 0x80U) == 0) {
    length = static_cast<std::size_t>(length_byte);
  } else {
    const std::size_t length_bytes = static_cast<std::size_t>(length_byte & 0x7fU);
    if (length_bytes == 0 || length_bytes > 4) {
      return ParseResult::kInvalid;
    }
    if (bytes.size() - cursor < length_bytes) {
      return ParseResult::kNeedMore;
    }
    for (std::size_t index = 0; index < length_bytes; ++index) {
      length = (length << 8U) | static_cast<std::size_t>(ByteAt(bytes, cursor + index));
    }
    cursor += length_bytes;
  }

  if (length > kMaxClientMessageBytes) {
    return ParseResult::kInvalid;
  }
  if (bytes.size() - cursor < length) {
    return ParseResult::kNeedMore;
  }

  view->tag = tag;
  view->value_offset = cursor;
  view->value_length = length;
  view->total_length = cursor - offset + length;
  return ParseResult::kComplete;
}

/// Recognize the exact root-DSE query emitted by oldap_perform_mechs. A plain
/// substring check would let a mutation-controlled data search for the same
/// attribute consume the peer-owned setup response, so every BER field that
/// distinguishes the fixed discovery request is checked fail closed. Routing
/// also requires the pre-bind state because a later data search can be byte
/// identical to this query.
/// @param value Value bytes of a searchRequest protocol operation.
/// @return true only for the supportedSASLMechanisms root-DSE query.
bool LdapMockServer::IsSaslMechanismSearch(std::string_view value) {
  std::size_t cursor = 0;
  TlvView field;
  const auto parse_field = [&value, &cursor](unsigned char tag, TlvView* parsed) {
    if (ParseTlv(value, cursor, parsed) != ParseResult::kComplete || parsed->tag != tag) {
      return false;
    }
    cursor = parsed->value_offset + parsed->value_length;
    return true;
  };
  const auto is_zero = [&value](const TlvView& parsed) {
    return parsed.value_length == 1 && ByteAt(value, parsed.value_offset) == 0;
  };

  if (!parse_field(kOctetStringTag, &field) || field.value_length != 0 || !parse_field(kEnumeratedTag, &field) ||
      !is_zero(field) || !parse_field(kEnumeratedTag, &field) || !is_zero(field) || !parse_field(kIntegerTag, &field) ||
      !is_zero(field) || !parse_field(kIntegerTag, &field) || !is_zero(field) || !parse_field(kBooleanTag, &field) ||
      !is_zero(field) || !parse_field(kPresentFilter, &field) ||
      value.substr(field.value_offset, field.value_length) != kObjectClass || !parse_field(kSequenceTag, &field) ||
      cursor != value.size()) {
    return false;
  }

  const std::size_t attributes_end = field.value_offset + field.value_length;
  TlvView attribute;
  if (ParseTlv(value, field.value_offset, &attribute) != ParseResult::kComplete || attribute.tag != kOctetStringTag ||
      attribute.value_offset + attribute.value_length != attributes_end) {
    return false;
  }
  return value.substr(attribute.value_offset, attribute.value_length) == kSupportedSaslMechanisms;
}

/// Decode an LDAPMessage envelope: SEQUENCE { messageID INTEGER, protocolOp }.
/// The peer needs the integer id and outer operation tag. Search bodies remain
/// opaque except for exact classification of OpenLDAP's fixed mechanism query,
/// so mutation-controlled data searches still reach OpenLDAP's BER parser.
/// @param bytes Buffer beginning at the message's first tag byte.
/// @param message Receives the decoded envelope fields.
/// @return kComplete, kNeedMore, or kInvalid.
LdapMockServer::ParseResult LdapMockServer::ParseMessage(std::string_view bytes, MessageView* message) {
  if (message == nullptr) {
    return ParseResult::kInvalid;
  }

  TlvView outer;
  ParseResult parsed = ParseTlv(bytes, 0, &outer);
  if (parsed != ParseResult::kComplete) {
    return parsed;
  }
  if (outer.tag != kSequenceTag || outer.value_length < 2) {
    return ParseResult::kInvalid;
  }

  const std::size_t outer_end = outer.value_offset + outer.value_length;
  TlvView integer;
  parsed = ParseTlv(bytes, outer.value_offset, &integer);
  if (parsed != ParseResult::kComplete) {
    return parsed;
  }
  if (integer.tag != kIntegerTag || integer.value_length == 0 || integer.value_length > 4 ||
      integer.value_offset + integer.value_length > outer_end) {
    return ParseResult::kInvalid;
  }

  std::uint32_t message_id = 0;
  for (std::size_t index = 0; index < integer.value_length; ++index) {
    message_id = (message_id << 8U) | static_cast<std::uint32_t>(ByteAt(bytes, integer.value_offset + index));
  }

  const std::size_t operation_offset = integer.value_offset + integer.value_length;
  if (operation_offset >= outer_end) {
    return ParseResult::kInvalid;
  }
  TlvView operation;
  parsed = ParseTlv(bytes, operation_offset, &operation);
  if (parsed != ParseResult::kComplete) {
    return parsed;
  }
  if (operation.value_offset + operation.value_length > outer_end) {
    return ParseResult::kInvalid;
  }

  message->op_tag = operation.tag;
  message->message_id = message_id;
  message->total_length = outer.total_length;
  message->sasl_mechanism_query = operation.tag == kSearchRequest &&
                                  IsSaslMechanismSearch(bytes.substr(operation.value_offset, operation.value_length));
  return ParseResult::kComplete;
}

/// Append a definite BER length. LDAP fuzz inputs remain far below the
/// long-form boundary in ordinary traffic, but server chunks are
/// mutation-controlled, so the encoder handles the full 32-bit size_t range
/// with the shortest representation.
/// @param out Destination string.
/// @param length Number of value bytes that follow.
void LdapMockServer::AppendBerLength(std::string* out, std::size_t length) {
  if (out == nullptr) {
    return;
  }
  if (length < 128) {
    out->push_back(static_cast<char>(length));
    return;
  }

  unsigned char encoded[sizeof(std::size_t)];
  std::size_t count = 0;
  while (length != 0) {
    encoded[count++] = static_cast<unsigned char>(length & 0xffU);
    length >>= 8U;
  }
  out->push_back(static_cast<char>(0x80U | count));
  while (count != 0) {
    out->push_back(static_cast<char>(encoded[--count]));
  }
}

/// Append one TLV with a definite length.
/// @param out Destination string.
/// @param tag BER identifier octet.
/// @param value Value bytes.
void LdapMockServer::AppendTlv(std::string* out, unsigned char tag, std::string_view value) {
  if (out == nullptr) {
    return;
  }
  out->push_back(static_cast<char>(tag));
  AppendBerLength(out, value.size());
  out->append(value.data(), value.size());
}

/// Append a minimally encoded non-negative BER INTEGER.
/// @param out Destination string.
/// @param value Integer to encode.
void LdapMockServer::AppendBerInteger(std::string* out, std::uint32_t value) {
  unsigned char encoded[5];
  std::size_t count = 0;
  do {
    encoded[count++] = static_cast<unsigned char>(value & 0xffU);
    value >>= 8U;
  } while (value != 0);

  std::string bytes;
  if ((encoded[count - 1] & 0x80U) != 0) {
    bytes.push_back('\0');
  }
  while (count != 0) {
    bytes.push_back(static_cast<char>(encoded[--count]));
  }
  AppendTlv(out, kIntegerTag, bytes);
}

/// Encode a bindResponse or searchResDone carrying a single result code and
/// empty matchedDN/diagnosticMessage fields. The peer echoes the request's
/// message id so OpenLDAP associates the reply with curl's outstanding call.
/// @param message_id Request message id.
/// @param op_tag kBindResponse or kSearchResultDone.
/// @param result_code LDAP resultCode (0 is success).
/// @param out Receives the complete LDAPMessage.
void LdapMockServer::BuildResultMessage(std::uint32_t message_id, unsigned char op_tag, int result_code,
                                        std::string* out) {
  if (out == nullptr) {
    return;
  }

  std::string result;
  const int bounded_code = std::max(0, std::min(result_code, 255));
  const char code_byte = static_cast<char>(bounded_code);
  AppendTlv(&result, kEnumeratedTag, std::string_view(&code_byte, 1));
  AppendTlv(&result, kOctetStringTag, std::string_view());
  AppendTlv(&result, kOctetStringTag, std::string_view());

  std::string content;
  AppendBerInteger(&content, message_id);
  AppendTlv(&content, op_tag, result);

  out->clear();
  AppendTlv(out, kSequenceTag, content);
}

/// Encode a root-DSE searchResEntry advertising the one deterministic SASL
/// mechanism that the in-process peer can complete without external state.
/// @param message_id Mechanism-search request id to echo.
/// @param out Receives the complete LDAPMessage.
void LdapMockServer::BuildSaslMechanismsEntry(std::uint32_t message_id, std::string* out) {
  if (out == nullptr) {
    return;
  }

  std::string values;
  AppendTlv(&values, kOctetStringTag, kPlainMechanism);

  std::string attribute;
  AppendTlv(&attribute, kOctetStringTag, kSupportedSaslMechanisms);
  AppendTlv(&attribute, kSetTag, values);

  std::string attributes;
  AppendTlv(&attributes, kSequenceTag, attribute);

  std::string entry;
  AppendTlv(&entry, kOctetStringTag, std::string_view());
  AppendTlv(&entry, kSequenceTag, attributes);

  std::string content;
  AppendBerInteger(&content, message_id);
  AppendTlv(&content, kSearchResultEntry, entry);

  out->clear();
  AppendTlv(out, kSequenceTag, content);
}

/// Replace the messageID of a complete LDAPMessage. Scripted server bytes are
/// mutation-controlled and may not know OpenLDAP's per-connection counter, so
/// this keeps a valid seed meaningful without rewriting the operation body.
/// @param message Complete LDAPMessage bytes.
/// @param message_id New envelope integer.
/// @param out Receives the rewritten message.
/// @return true when the envelope parsed and was rewritten; false leaves `out`
///         unspecified and the caller should relay the original bytes.
bool LdapMockServer::RewriteMessageId(std::string_view message, std::uint32_t message_id, std::string* out) {
  if (out == nullptr) {
    return false;
  }

  TlvView outer;
  if (ParseTlv(message, 0, &outer) != ParseResult::kComplete || outer.tag != kSequenceTag ||
      outer.total_length != message.size()) {
    return false;
  }

  TlvView integer;
  if (ParseTlv(message, outer.value_offset, &integer) != ParseResult::kComplete || integer.tag != kIntegerTag ||
      integer.value_offset + integer.value_length > outer.value_offset + outer.value_length) {
    return false;
  }

  std::string content;
  AppendBerInteger(&content, message_id);
  const std::size_t remainder_offset = integer.value_offset + integer.value_length;
  const std::size_t outer_end = outer.value_offset + outer.value_length;
  content.append(message.data() + remainder_offset, outer_end - remainder_offset);

  out->clear();
  AppendTlv(out, kSequenceTag, content);
  return true;
}

/// Extract only the protocol operation tag from a complete server message.
/// @param message Candidate LDAPMessage bytes.
/// @param op_tag Receives the operation tag.
/// @return true when the envelope parsed completely.
bool LdapMockServer::MessageOpTag(std::string_view message, unsigned char* op_tag) {
  if (op_tag == nullptr) {
    return false;
  }
  MessageView decoded;
  if (ParseMessage(message, &decoded) != ParseResult::kComplete || decoded.total_length != message.size()) {
    return false;
  }
  *op_tag = decoded.op_tag;
  return true;
}

/// Reset every borrowed pointer, parser cursor, and observable capture before
/// borrowing the next Scenario.
/// @param scenario Scenario whose Connection supplies the bind reply and
///                 search-result messages.
void LdapMockServer::ResetForScenario(const curl::fuzzer::proto::Scenario& scenario) {
  connection_.reset();
  scenario_ = &scenario;
  server_chunk_count_ = std::min<std::size_t>(scenario_limits::kMaxResponseChunks,
                                              static_cast<std::size_t>(scenario.connection().on_readable_size()));
  next_server_chunk_ = 0;
  bind_request_count_ = 0;
  search_request_count_ = 0;
  mechanism_search_request_count_ = 0;
  starttls_request_count_ = 0;
  unbind_request_count_ = 0;
  server_message_count_ = 0;
  scripted_message_count_ = 0;
  synthesized_done_count_ = 0;
  scripted_bind_response_count_ = 0;
  pending_client_bytes_.clear();
  packet_transcript_.clear();
  search_message_id_ = 0;
  search_active_ = false;
  search_done_sent_ = false;
  scripted_bind_consumed_ = false;
  release_script_chunks_ = false;
  peer_closed_ = false;
  protocol_error_ = false;
  socket_opened_ = false;
}

/// Apply bounded transport knobs when creating the scripted socket. Target
/// policies normally clear LDAP backpressure, but direct corpus replay must
/// retain deterministic, well-defined behavior.
/// @param connection Peer receiving the socket settings.
/// @param script Connection script carrying optional backpressure values.
void LdapMockServer::ApplyScriptBackpressure(MockConnection* connection,
                                             const curl::fuzzer::proto::Connection& script) {
  if (connection == nullptr) {
    return;
  }

  const std::uint32_t int_max = static_cast<std::uint32_t>(std::numeric_limits<int>::max());
  const auto& backpressure = script.backpressure();
  const int receive_buffer = static_cast<int>(std::min(backpressure.recv_buf_bytes(), int_max));
  connection->ApplyBackpressure(receive_buffer, static_cast<std::size_t>(backpressure.drain_limit()));
}

/// Create the default plaintext transport. The LDAPS subclass overrides this
/// factory, which keeps every BER handling path identical across carriers.
/// @return Newly allocated in-process socketpair peer.
std::unique_ptr<MockConnection> LdapMockServer::CreateConnection() { return std::make_unique<MockConnection>(); }

/// Create the single LDAP socketpair. The bind reply is deliberately not
/// queued here: LDAP is client-first, and releasing the scripted reply only
/// after the bindRequest lets the peer rewrite its messageID to OpenLDAP's
/// current counter.
/// @param purpose Socket role requested by curl.
/// @param address Unused stream destination metadata required by the callback
///                signature.
/// @return Client descriptor for the LDAP channel, or CURL_SOCKET_BAD.
curl_socket_t LdapMockServer::HandleOpenSocket(curlsocktype purpose, struct curl_sockaddr* /*address*/) {
  if (scenario_ == nullptr || purpose != CURLSOCKTYPE_IPCXN || socket_opened_) {
    return CURL_SOCKET_BAD;
  }

  connection_ = CreateConnection();
  if (!connection_ || !connection_->ok()) {
    connection_.reset();
    return CURL_SOCKET_BAD;
  }
  connection_->SetIncomingDataObserver(this);

  ApplyScriptBackpressure(connection_.get(), scenario_->connection());
  socket_opened_ = true;
  return connection_->take_client_fd();
}

/// Retain only a bounded prefix for assertions. Parsing and draining continue
/// against the full transport bytes, so reaching the cap cannot change curl's
/// behavior or manufacture socket backpressure.
/// @param source Newly observed bytes.
/// @param limit Maximum retained destination size.
/// @param destination Capture buffer receiving the available prefix.
void LdapMockServer::CapturePrefix(std::string_view source, std::size_t limit, std::string* destination) {
  if (destination == nullptr || destination->size() >= limit) {
    return;
  }
  const std::size_t available = limit - destination->size();
  destination->append(source.data(), std::min(source.size(), available));
}

/// Keep failed peer writes local to the mock. Response cursors must still
/// advance after curl closes early, otherwise a replacement socket could see a
/// reply intended for an earlier request.
/// @param bytes Response bytes to queue.
/// @return true when the complete fragment was queued.
bool LdapMockServer::WriteServerBytes(std::string_view bytes) {
  if (bytes.empty()) {
    return true;
  }
  const bool written = connection_ != nullptr &&
                       connection_->WriteAll(reinterpret_cast<const unsigned char*>(bytes.data()), bytes.size());
  if (written) {
    ++server_message_count_;
  }
  return written;
}

/// Answer one bindRequest. A non-empty initial_response is the scenario's bind
/// reply and is renumbered to the request id; otherwise a success response is
/// synthesized. Reusing the script only once preserves OpenLDAP's protocol-v2
/// fallback path, which sends a second bind after a protocol-error reply.
/// @param message_id Client bind message id.
void LdapMockServer::HandleBindRequest(std::uint32_t message_id) {
  ++bind_request_count_;

  std::string response;
  if (!scripted_bind_consumed_ && scenario_ != nullptr && !scenario_->connection().initial_response().empty()) {
    const std::string& scripted = scenario_->connection().initial_response();
    if (!RewriteMessageId(scripted, message_id, &response)) {
      response = scripted;
    }
    scripted_bind_consumed_ = true;
    ++scripted_bind_response_count_;
  } else {
    BuildResultMessage(message_id, kBindResponse, kLdapSuccess, &response);
  }
  (void)WriteServerBytes(response);
}

/// Begin (or restart) the search script. Result chunks are released one per
/// drive turn so curl consumes each LDAPMessage before the next arrives; the
/// terminal done follows once the cursor is exhausted.
/// @param message_id Client search message id.
void LdapMockServer::HandleSearchRequest(std::uint32_t message_id) {
  ++search_request_count_;
  search_message_id_ = message_id;
  search_active_ = true;
  search_done_sent_ = false;
  release_script_chunks_ = true;
  next_server_chunk_ = 0;
}

/// Answer OpenLDAP's root-DSE SASL discovery search before the ordinary bind
/// and URL-derived search. Keeping this response peer-owned prevents mutable
/// search-result scripts from being consumed by the setup query.
/// @param message_id Mechanism-search request id to echo.
void LdapMockServer::HandleMechanismSearchRequest(std::uint32_t message_id) {
  ++search_request_count_;
  ++mechanism_search_request_count_;

  std::string entry;
  BuildSaslMechanismsEntry(message_id, &entry);
  (void)WriteServerBytes(entry);

  std::string done;
  BuildResultMessage(message_id, kSearchResultDone, kLdapSuccess, &done);
  ++synthesized_done_count_;
  (void)WriteServerBytes(done);
}

/// Accept the RFC 4511 StartTLS ExtendedRequest. The successful correlated
/// response makes OpenLDAP return control to curl, which installs its TLS
/// connection filter on the existing confined socketpair. This plaintext peer
/// deliberately does not impersonate a TLS server after the upgrade: the
/// subsequent handshake observes a bounded EOF/error path while still
/// exercising the production filter transition.
/// @param message_id Client request identifier echoed in ExtendedResponse.
void LdapMockServer::HandleStartTlsRequest(std::uint32_t message_id) {
  ++starttls_request_count_;
  std::string response;
  BuildResultMessage(message_id, kExtendedResponse, kLdapSuccess, &response);
  (void)WriteServerBytes(response);
}

/// Route one complete client message. Unknown protocol operations are consumed
/// without a reply, matching LDAP's asymmetry: bind, search, and StartTLS
/// expect responses, while unbind/abandon are fire-and-forget.
/// @param message Decoded client envelope.
void LdapMockServer::HandleClientMessage(const MessageView& message) {
  switch (message.op_tag) {
    case kBindRequest:
      HandleBindRequest(message.message_id);
      return;

    case kSearchRequest:
      if (message.sasl_mechanism_query && bind_request_count_ == 0 && mechanism_search_request_count_ == 0) {
        HandleMechanismSearchRequest(message.message_id);
      } else {
        HandleSearchRequest(message.message_id);
      }
      return;

    case kExtendedRequest:
      HandleStartTlsRequest(message.message_id);
      return;

    case kUnbindRequest:
      ++unbind_request_count_;
      return;

    case kAbandonRequest:
      return;

    default:
      return;
  }
}

/// Release one scenario-provided search-result message. Chunks are opaque BER
/// LDAPMessages rather than command replies: each is forwarded with its
/// envelope messageID rewritten to the active search id. A scripted
/// searchResDone ends the search so no duplicate completion is synthesized; an
/// explicitly empty chunk half-closes the peer for a truncated-stream path.
/// @return true when a script slot was consumed.
bool LdapMockServer::ReleaseNextServerChunk() {
  if (!release_script_chunks_ || scenario_ == nullptr || connection_ == nullptr ||
      next_server_chunk_ >= server_chunk_count_) {
    return false;
  }

  const std::string& chunk = scenario_->connection().on_readable(static_cast<int>(next_server_chunk_));
  ++next_server_chunk_;

  if (chunk.empty()) {
    connection_->ShutdownWrite();
    peer_closed_ = true;
    release_script_chunks_ = false;
    return true;
  }

  unsigned char op_tag = 0;
  const bool has_op_tag = MessageOpTag(chunk, &op_tag);
  std::string rewritten;
  const bool renumbered = RewriteMessageId(chunk, search_message_id_, &rewritten);
  const std::string_view bytes = renumbered ? std::string_view(rewritten) : std::string_view(chunk);

  ++scripted_message_count_;
  (void)WriteServerBytes(bytes);
  if (has_op_tag && op_tag == kSearchResultDone) {
    search_done_sent_ = true;
    release_script_chunks_ = false;
  }
  return true;
}

/// Complete an outstanding search once its script cursor is exhausted. A
/// scripted done (or an explicit truncation) suppresses this synthesized
/// message, so the peer never invents completion after a deliberate error.
/// @return true when a searchResDone was written.
bool LdapMockServer::FinishSearchIfReady() {
  if (!search_active_ || search_done_sent_ || peer_closed_ || connection_ == nullptr) {
    return false;
  }
  if (release_script_chunks_ && next_server_chunk_ < server_chunk_count_) {
    return false;
  }

  std::string done;
  BuildResultMessage(search_message_id_, kSearchResultDone, kLdapSuccess, &done);
  ++synthesized_done_count_;
  search_done_sent_ = true;
  release_script_chunks_ = false;
  return WriteServerBytes(done);
}

/// Read without waiting and process every complete LDAPMessage currently
/// buffered. A message is delivered only after its outer TLV has fully
/// arrived, so fragmentation cannot shift the parser. DrainIncoming() also
/// advances a layered TLS carrier, and reports its handshake progress so the
/// outer loop does not mistake useful negotiation for an idle peer.
/// @return true when bytes, a message, or a transport state advanced.
bool LdapMockServer::ServiceClientConnection() {
  if (connection_ == nullptr || protocol_error_ || peer_closed_) {
    return false;
  }

  const std::size_t size_before_read = pending_client_bytes_.size();
  const std::size_t transport_progress = connection_->DrainIncoming();
  bool made_progress = pending_client_bytes_.size() != size_before_read || transport_progress != 0;

  std::size_t consumed = 0;
  int messages = 0;
  while (consumed < pending_client_bytes_.size() && messages < kMaxMessagesPerService) {
    const std::string_view available(pending_client_bytes_.data() + consumed, pending_client_bytes_.size() - consumed);
    MessageView message;
    const ParseResult parsed = ParseMessage(available, &message);
    if (parsed == ParseResult::kNeedMore) {
      break;
    }
    if (parsed == ParseResult::kInvalid) {
      protocol_error_ = true;
      break;
    }

    const std::string_view complete = available.substr(0, message.total_length);
    CapturePrefix(complete, kMaxCapturedMessageBytes, &packet_transcript_);
    HandleClientMessage(message);
    consumed += message.total_length;
    ++messages;
    made_progress = true;
  }

  if (protocol_error_) {
    pending_client_bytes_.clear();
    // Close the write half immediately so a bogus length cannot wait on the
    // idle budget for an impossible body.
    connection_->ShutdownWrite();
    release_script_chunks_ = false;
  } else if (consumed != 0) {
    pending_client_bytes_.erase(0, consumed);
  }
  return made_progress;
}

/// Half-close the peer so curl observes a deterministic end of server messages
/// after the transfer has stopped or the idle budget expired.
void LdapMockServer::FinishConnections() {
  if (connection_ != nullptr) {
    connection_->ShutdownWrite();
  }
}

/// Alternate curl transitions with immediate peer service until the transfer
/// completes or deterministic idle/operation caps win. No select(), poll(), or
/// sleep is needed: OpenLDAP reads through a duplicate of the same in-process
/// socketpair endpoint that curl opened, so the peer can answer requests
/// synchronously from this thread.
/// @param multi Multi handle containing `easy`.
/// @param easy Easy handle already installed on this mock.
/// @param scenario Connection script to borrow.
void LdapMockServer::RunLoop(CURLM* multi, CURL* easy, const curl::fuzzer::proto::Scenario& scenario) {
  (void)easy;
  ResetForScenario(scenario);

  int still_running = 1;
  int idle_iterations = 0;
  int drive_iterations = 0;
  CURLMcode result = CURLM_OK;
  while (still_running && idle_iterations < kMaxIdleIterations && drive_iterations++ < kMaxDriveIterations) {
    const int running_before = still_running;
    result = curl_multi_perform(multi, &still_running);
    if (result != CURLM_OK) {
      break;
    }

    bool made_progress = still_running != running_before;
    made_progress = ServiceClientConnection() || made_progress;
    made_progress = ReleaseNextServerChunk() || made_progress;
    made_progress = FinishSearchIfReady() || made_progress;
    if (made_progress) {
      idle_iterations = 0;
    } else {
      ++idle_iterations;
    }
  }

  // The final perform may have emitted a request immediately before marking
  // the transfer done. Drain those bytes before cleanup.
  (void)ServiceClientConnection();
  (void)ReleaseNextServerChunk();
  (void)FinishSearchIfReady();
  FinishConnections();
  scenario_ = nullptr;
}

}  // namespace proto_fuzzer

Coverage Report

Created: 2026-10-28 07:17