/src/curl_fuzzer/proto_fuzzer/target_profile.h
Line | Count | Source |
1 | | /* |
2 | | * Copyright (C) Max Dymond, <cmeister2@gmail.com>, et al. |
3 | | * |
4 | | * SPDX-License-Identifier: curl |
5 | | */ |
6 | | |
7 | | /// @file |
8 | | /// @brief Compile-time identities and execution modes for proto fuzz targets. |
9 | | |
10 | | #ifndef PROTO_FUZZER_TARGET_PROFILE_H_ |
11 | | #define PROTO_FUZZER_TARGET_PROFILE_H_ |
12 | | |
13 | | namespace proto_fuzzer { |
14 | | |
15 | | /// Identifies one compiled proto-fuzzer lane. A profile is the single source |
16 | | /// of truth for both mutation constraints and runtime coverage policy, which |
17 | | /// prevents independent flags from describing combinations no target uses. |
18 | | enum class TargetProfile { |
19 | | /// Preserve the original mixed target and its accumulated corpus exactly. |
20 | | kCompatibility, |
21 | | /// Keep ordinary HTTP iterations competitive with the legacy byte fuzzers. |
22 | | kFastHttp, |
23 | | /// Retain HTTP's complete structured request and response surface. |
24 | | kDeepHttp, |
25 | | /// Exercise a complete HTTPS exchange against the in-process TLS peer. |
26 | | kFastHttps, |
27 | | /// Exercise raw HTTP/2 origin frames after a verified TLS/ALPN handshake. |
28 | | kHttpsH2, |
29 | | /// Exercise HTTP/2 origin frames over plaintext prior knowledge. |
30 | | kFastHttp2, |
31 | | /// Exercise HTTP/3 over a valid in-process QUIC/TLS connection. |
32 | | kFastHttp3, |
33 | | /// Exercise an HTTP/1.1 origin through an HTTPS/HTTP2 CONNECT proxy. |
34 | | kH2Proxy, |
35 | | /// Exercise HTTP through an in-process SOCKS proxy, optionally preceded by |
36 | | /// a HAProxy protocol-v1 prefix after tunnel establishment. |
37 | | kProxyTransport, |
38 | | /// Exercise localhost lookup and structured CURLOPT_RESOLVE host-cache work. |
39 | | kResolver, |
40 | | /// Exercise plaintext WebSocket framing without wall-clock waits. |
41 | | kFastWebSocket, |
42 | | /// Exercise WebSocket framing through a verified TLS connection. |
43 | | kFastSecureWebSocket, |
44 | | /// Exercise bounded TELNET negotiation and callback-backed input. |
45 | | kFastTelnet, |
46 | | /// Exercise FTP control and passive data connections, including implicit-TLS |
47 | | /// FTPS, without external I/O. |
48 | | kFastFtp, |
49 | | /// Exercise packet-preserving TFTP exchanges over the loopback UDP peer. |
50 | | kFastTftp, |
51 | | /// Exercise single-connection SMTP and implicit-TLS SMTPS mail transfers. |
52 | | kFastSmtp, |
53 | | /// Exercise single-connection IMAP mailbox transfers through the control peer. |
54 | | kFastImap, |
55 | | /// Exercise single-connection POP3 mailbox transfers through the control peer. |
56 | | kFastPop3, |
57 | | /// Exercise binary MQTT and implicit-TLS MQTTS CONNECT/PUBLISH/SUBSCRIBE |
58 | | /// exchanges through the packet-aware single-socket peer. |
59 | | kFastMqtt, |
60 | | /// Exercise line-based DICT lookups through the raw stream peer. |
61 | | kFastDict, |
62 | | /// Exercise Gopher selectors through the bounded stream peer. |
63 | | kFastGopher, |
64 | | /// Exercise file:// URL parsing against a fixed read-only local target. |
65 | | kFastFile, |
66 | | /// Exercise binary BER LDAP bind and search exchanges through the |
67 | | /// OpenLDAP-backed single-socket peer. |
68 | | kFastLdap, |
69 | | /// Exercise RTSP request/response exchanges and interleaved RTP delivery |
70 | | /// through the request-aligned stream peer. |
71 | | kFastRtsp, |
72 | | /// Exercise curl's ipfs:// and ipns:// gateway rewrite as an ordinary HTTP |
73 | | /// GET against the in-process HTTP peer. |
74 | | kFastIpfs, |
75 | | /// Exercise easy, share, multi, URL, and result API lifecycles. |
76 | | kApi, |
77 | | /// Exercise several easy handles through one shared multi handle. |
78 | | kMulti, |
79 | | /// Isolate deterministic backpressure and timed-wait behavior. |
80 | | kTiming, |
81 | | }; |
82 | | |
83 | | /// Selects one of the complete, valid RunScenario behaviours. Keeping this |
84 | | /// closed set avoids boolean combinations that have no useful interpretation. |
85 | | enum class ScenarioRunMode { |
86 | | /// Drive the protocol without charging its hot loop for generic API probes. |
87 | | kFastProtocol, |
88 | | /// Drive the protocol and inspect a compact set of public result APIs. |
89 | | kProtocolCoverage, |
90 | | /// Drive deep HTTP plus its bounded filename-backed parser inputs. |
91 | | kDeepHttpCoverage, |
92 | | /// Drive HTTPS through a real TLS peer and inspect live TLS result state. |
93 | | kTlsCoverage, |
94 | | /// Drive WebSocket framing through a verified in-process TLS peer. |
95 | | kTlsWebSocketCoverage, |
96 | | /// Drive an HTTPS origin through fixed ALPN h2 with push/upkeep probes. |
97 | | kTlsHttp2Coverage, |
98 | | /// Drive a plaintext HTTP/2 prior-knowledge origin with the H2 peer. |
99 | | kHttp2Coverage, |
100 | | /// Drive ordered plaintext HTTP/3 actions through the QUIC peer. |
101 | | kHttp3Coverage, |
102 | | /// Drive raw HTTP/2 proxy frames around one CONNECT tunnel. |
103 | | kH2ProxyCoverage, |
104 | | /// Drive request-triggered SOCKS4/SOCKS5 negotiation, optional HAProxy |
105 | | /// framing, and the tunneled HTTP exchange. |
106 | | kProxyTransportCoverage, |
107 | | /// Let curl resolve the origin while the socket callback still owns I/O. |
108 | | kResolverCoverage, |
109 | | /// Drive FTP or FTPS through its concurrent control/passive-data peer. |
110 | | kFtpCoverage, |
111 | | /// Drive TFTP through its datagram-preserving loopback peer. |
112 | | kTftpCoverage, |
113 | | /// Drive SMTP or SMTPS through its command-aware control peer, including the |
114 | | /// DATA body exchange. |
115 | | kSmtpCoverage, |
116 | | /// Drive IMAP through its command-aware control peer, including literals. |
117 | | kImapCoverage, |
118 | | /// Drive POP3 through its command-aware control peer, including RETR bodies. |
119 | | kPop3Coverage, |
120 | | /// Drive MQTT or MQTTS through its packet-aware single-socket peer. |
121 | | kMqttCoverage, |
122 | | /// Drive DICT lookups through its command-aware stream peer and EOF-framed |
123 | | /// response body. |
124 | | kDictCoverage, |
125 | | /// Drive Gopher through the bounded stream peer. |
126 | | kGopherCoverage, |
127 | | /// Drive file:// without a peer, reading only the canonical local target. |
128 | | kFileCoverage, |
129 | | /// Drive LDAP through its BER-aware single-socket peer, including the bind |
130 | | /// reply and scripted search-result messages. |
131 | | kLdapCoverage, |
132 | | /// Drive RTSP through its request-aligned control peer, including response |
133 | | /// bodies and interleaved RTP data. |
134 | | kRtspCoverage, |
135 | | /// Honour ApiPlan and run the dedicated lifecycle and typed-result probes. |
136 | | kApiLifecycle, |
137 | | /// Honour MultiPlan and drive several HTTP transfers through one multi. |
138 | | kMultiTransfer, |
139 | | }; |
140 | | |
141 | | /// Derive runtime behaviour from the compiled target identity. Mutation policy |
142 | | /// remains profile-specific, while targets that need the same execution cost |
143 | | /// deliberately share a run mode. |
144 | | /// @param profile Compiled target whose runner behaviour is required. |
145 | | /// @return The only RunScenario mode valid for that target. |
146 | 240k | constexpr ScenarioRunMode RunModeFor(TargetProfile profile) { |
147 | 240k | switch (profile) { |
148 | 12.2k | case TargetProfile::kFastHttp: |
149 | 16.6k | case TargetProfile::kFastTelnet: |
150 | 25.9k | case TargetProfile::kFastIpfs: |
151 | 25.9k | return ScenarioRunMode::kFastProtocol; |
152 | | |
153 | 11.7k | case TargetProfile::kApi: |
154 | 11.7k | return ScenarioRunMode::kApiLifecycle; |
155 | | |
156 | 12.1k | case TargetProfile::kMulti: |
157 | 12.1k | return ScenarioRunMode::kMultiTransfer; |
158 | | |
159 | 27.2k | case TargetProfile::kFastHttps: |
160 | 27.2k | return ScenarioRunMode::kTlsCoverage; |
161 | | |
162 | 7.34k | case TargetProfile::kFastSecureWebSocket: |
163 | 7.34k | return ScenarioRunMode::kTlsWebSocketCoverage; |
164 | | |
165 | 12.0k | case TargetProfile::kHttpsH2: |
166 | 12.0k | return ScenarioRunMode::kTlsHttp2Coverage; |
167 | | |
168 | 14.7k | case TargetProfile::kFastHttp2: |
169 | 14.7k | return ScenarioRunMode::kHttp2Coverage; |
170 | | |
171 | 6.67k | case TargetProfile::kFastHttp3: |
172 | 6.67k | return ScenarioRunMode::kHttp3Coverage; |
173 | | |
174 | 10.7k | case TargetProfile::kH2Proxy: |
175 | 10.7k | return ScenarioRunMode::kH2ProxyCoverage; |
176 | | |
177 | 7.95k | case TargetProfile::kProxyTransport: |
178 | 7.95k | return ScenarioRunMode::kProxyTransportCoverage; |
179 | | |
180 | 7.85k | case TargetProfile::kResolver: |
181 | 7.85k | return ScenarioRunMode::kResolverCoverage; |
182 | | |
183 | 6.10k | case TargetProfile::kFastFtp: |
184 | 6.10k | return ScenarioRunMode::kFtpCoverage; |
185 | | |
186 | 2.23k | case TargetProfile::kFastTftp: |
187 | 2.23k | return ScenarioRunMode::kTftpCoverage; |
188 | | |
189 | 4.84k | case TargetProfile::kFastSmtp: |
190 | 4.84k | return ScenarioRunMode::kSmtpCoverage; |
191 | | |
192 | 5.14k | case TargetProfile::kFastImap: |
193 | 5.14k | return ScenarioRunMode::kImapCoverage; |
194 | | |
195 | 3.82k | case TargetProfile::kFastPop3: |
196 | 3.82k | return ScenarioRunMode::kPop3Coverage; |
197 | | |
198 | 4.04k | case TargetProfile::kFastMqtt: |
199 | 4.04k | return ScenarioRunMode::kMqttCoverage; |
200 | | |
201 | 3.21k | case TargetProfile::kFastDict: |
202 | 3.21k | return ScenarioRunMode::kDictCoverage; |
203 | | |
204 | 7.56k | case TargetProfile::kFastGopher: |
205 | 7.56k | return ScenarioRunMode::kGopherCoverage; |
206 | | |
207 | 3.57k | case TargetProfile::kFastFile: |
208 | 3.57k | return ScenarioRunMode::kFileCoverage; |
209 | | |
210 | 5.76k | case TargetProfile::kFastLdap: |
211 | 5.76k | return ScenarioRunMode::kLdapCoverage; |
212 | | |
213 | 6.30k | case TargetProfile::kFastRtsp: |
214 | 6.30k | return ScenarioRunMode::kRtspCoverage; |
215 | | |
216 | 12.0k | case TargetProfile::kCompatibility: |
217 | 21.1k | case TargetProfile::kFastWebSocket: |
218 | 31.1k | case TargetProfile::kTiming: |
219 | 31.1k | return ScenarioRunMode::kProtocolCoverage; |
220 | | |
221 | 12.6k | case TargetProfile::kDeepHttp: |
222 | 12.6k | return ScenarioRunMode::kDeepHttpCoverage; |
223 | 240k | } |
224 | 0 | return ScenarioRunMode::kProtocolCoverage; |
225 | 240k | } |
226 | | |
227 | | } // namespace proto_fuzzer |
228 | | |
229 | | #endif // PROTO_FUZZER_TARGET_PROFILE_H_ |