Coverage Report

Created: 2026-10-28 07:17

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/curl_fuzzer/proto_fuzzer/target_profile.h
Line
Count
Source
1
/*
2
 * Copyright (C) Max Dymond, <cmeister2@gmail.com>, et al.
3
 *
4
 * SPDX-License-Identifier: curl
5
 */
6
7
/// @file
8
/// @brief Compile-time identities and execution modes for proto fuzz targets.
9
10
#ifndef PROTO_FUZZER_TARGET_PROFILE_H_
11
#define PROTO_FUZZER_TARGET_PROFILE_H_
12
13
namespace proto_fuzzer {
14
15
/// Identifies one compiled proto-fuzzer lane. A profile is the single source
16
/// of truth for both mutation constraints and runtime coverage policy, which
17
/// prevents independent flags from describing combinations no target uses.
18
enum class TargetProfile {
19
  /// Preserve the original mixed target and its accumulated corpus exactly.
20
  kCompatibility,
21
  /// Keep ordinary HTTP iterations competitive with the legacy byte fuzzers.
22
  kFastHttp,
23
  /// Retain HTTP's complete structured request and response surface.
24
  kDeepHttp,
25
  /// Exercise a complete HTTPS exchange against the in-process TLS peer.
26
  kFastHttps,
27
  /// Exercise raw HTTP/2 origin frames after a verified TLS/ALPN handshake.
28
  kHttpsH2,
29
  /// Exercise HTTP/2 origin frames over plaintext prior knowledge.
30
  kFastHttp2,
31
  /// Exercise HTTP/3 over a valid in-process QUIC/TLS connection.
32
  kFastHttp3,
33
  /// Exercise an HTTP/1.1 origin through an HTTPS/HTTP2 CONNECT proxy.
34
  kH2Proxy,
35
  /// Exercise HTTP through an in-process SOCKS proxy, optionally preceded by
36
  /// a HAProxy protocol-v1 prefix after tunnel establishment.
37
  kProxyTransport,
38
  /// Exercise localhost lookup and structured CURLOPT_RESOLVE host-cache work.
39
  kResolver,
40
  /// Exercise plaintext WebSocket framing without wall-clock waits.
41
  kFastWebSocket,
42
  /// Exercise WebSocket framing through a verified TLS connection.
43
  kFastSecureWebSocket,
44
  /// Exercise bounded TELNET negotiation and callback-backed input.
45
  kFastTelnet,
46
  /// Exercise FTP control and passive data connections, including implicit-TLS
47
  /// FTPS, without external I/O.
48
  kFastFtp,
49
  /// Exercise packet-preserving TFTP exchanges over the loopback UDP peer.
50
  kFastTftp,
51
  /// Exercise single-connection SMTP and implicit-TLS SMTPS mail transfers.
52
  kFastSmtp,
53
  /// Exercise single-connection IMAP mailbox transfers through the control peer.
54
  kFastImap,
55
  /// Exercise single-connection POP3 mailbox transfers through the control peer.
56
  kFastPop3,
57
  /// Exercise binary MQTT and implicit-TLS MQTTS CONNECT/PUBLISH/SUBSCRIBE
58
  /// exchanges through the packet-aware single-socket peer.
59
  kFastMqtt,
60
  /// Exercise line-based DICT lookups through the raw stream peer.
61
  kFastDict,
62
  /// Exercise Gopher selectors through the bounded stream peer.
63
  kFastGopher,
64
  /// Exercise file:// URL parsing against a fixed read-only local target.
65
  kFastFile,
66
  /// Exercise binary BER LDAP bind and search exchanges through the
67
  /// OpenLDAP-backed single-socket peer.
68
  kFastLdap,
69
  /// Exercise RTSP request/response exchanges and interleaved RTP delivery
70
  /// through the request-aligned stream peer.
71
  kFastRtsp,
72
  /// Exercise curl's ipfs:// and ipns:// gateway rewrite as an ordinary HTTP
73
  /// GET against the in-process HTTP peer.
74
  kFastIpfs,
75
  /// Exercise easy, share, multi, URL, and result API lifecycles.
76
  kApi,
77
  /// Exercise several easy handles through one shared multi handle.
78
  kMulti,
79
  /// Isolate deterministic backpressure and timed-wait behavior.
80
  kTiming,
81
};
82
83
/// Selects one of the complete, valid RunScenario behaviours. Keeping this
84
/// closed set avoids boolean combinations that have no useful interpretation.
85
enum class ScenarioRunMode {
86
  /// Drive the protocol without charging its hot loop for generic API probes.
87
  kFastProtocol,
88
  /// Drive the protocol and inspect a compact set of public result APIs.
89
  kProtocolCoverage,
90
  /// Drive deep HTTP plus its bounded filename-backed parser inputs.
91
  kDeepHttpCoverage,
92
  /// Drive HTTPS through a real TLS peer and inspect live TLS result state.
93
  kTlsCoverage,
94
  /// Drive WebSocket framing through a verified in-process TLS peer.
95
  kTlsWebSocketCoverage,
96
  /// Drive an HTTPS origin through fixed ALPN h2 with push/upkeep probes.
97
  kTlsHttp2Coverage,
98
  /// Drive a plaintext HTTP/2 prior-knowledge origin with the H2 peer.
99
  kHttp2Coverage,
100
  /// Drive ordered plaintext HTTP/3 actions through the QUIC peer.
101
  kHttp3Coverage,
102
  /// Drive raw HTTP/2 proxy frames around one CONNECT tunnel.
103
  kH2ProxyCoverage,
104
  /// Drive request-triggered SOCKS4/SOCKS5 negotiation, optional HAProxy
105
  /// framing, and the tunneled HTTP exchange.
106
  kProxyTransportCoverage,
107
  /// Let curl resolve the origin while the socket callback still owns I/O.
108
  kResolverCoverage,
109
  /// Drive FTP or FTPS through its concurrent control/passive-data peer.
110
  kFtpCoverage,
111
  /// Drive TFTP through its datagram-preserving loopback peer.
112
  kTftpCoverage,
113
  /// Drive SMTP or SMTPS through its command-aware control peer, including the
114
  /// DATA body exchange.
115
  kSmtpCoverage,
116
  /// Drive IMAP through its command-aware control peer, including literals.
117
  kImapCoverage,
118
  /// Drive POP3 through its command-aware control peer, including RETR bodies.
119
  kPop3Coverage,
120
  /// Drive MQTT or MQTTS through its packet-aware single-socket peer.
121
  kMqttCoverage,
122
  /// Drive DICT lookups through its command-aware stream peer and EOF-framed
123
  /// response body.
124
  kDictCoverage,
125
  /// Drive Gopher through the bounded stream peer.
126
  kGopherCoverage,
127
  /// Drive file:// without a peer, reading only the canonical local target.
128
  kFileCoverage,
129
  /// Drive LDAP through its BER-aware single-socket peer, including the bind
130
  /// reply and scripted search-result messages.
131
  kLdapCoverage,
132
  /// Drive RTSP through its request-aligned control peer, including response
133
  /// bodies and interleaved RTP data.
134
  kRtspCoverage,
135
  /// Honour ApiPlan and run the dedicated lifecycle and typed-result probes.
136
  kApiLifecycle,
137
  /// Honour MultiPlan and drive several HTTP transfers through one multi.
138
  kMultiTransfer,
139
};
140
141
/// Derive runtime behaviour from the compiled target identity. Mutation policy
142
/// remains profile-specific, while targets that need the same execution cost
143
/// deliberately share a run mode.
144
/// @param profile Compiled target whose runner behaviour is required.
145
/// @return The only RunScenario mode valid for that target.
146
240k
constexpr ScenarioRunMode RunModeFor(TargetProfile profile) {
147
240k
  switch (profile) {
148
12.2k
    case TargetProfile::kFastHttp:
149
16.6k
    case TargetProfile::kFastTelnet:
150
25.9k
    case TargetProfile::kFastIpfs:
151
25.9k
      return ScenarioRunMode::kFastProtocol;
152
153
11.7k
    case TargetProfile::kApi:
154
11.7k
      return ScenarioRunMode::kApiLifecycle;
155
156
12.1k
    case TargetProfile::kMulti:
157
12.1k
      return ScenarioRunMode::kMultiTransfer;
158
159
27.2k
    case TargetProfile::kFastHttps:
160
27.2k
      return ScenarioRunMode::kTlsCoverage;
161
162
7.34k
    case TargetProfile::kFastSecureWebSocket:
163
7.34k
      return ScenarioRunMode::kTlsWebSocketCoverage;
164
165
12.0k
    case TargetProfile::kHttpsH2:
166
12.0k
      return ScenarioRunMode::kTlsHttp2Coverage;
167
168
14.7k
    case TargetProfile::kFastHttp2:
169
14.7k
      return ScenarioRunMode::kHttp2Coverage;
170
171
6.67k
    case TargetProfile::kFastHttp3:
172
6.67k
      return ScenarioRunMode::kHttp3Coverage;
173
174
10.7k
    case TargetProfile::kH2Proxy:
175
10.7k
      return ScenarioRunMode::kH2ProxyCoverage;
176
177
7.95k
    case TargetProfile::kProxyTransport:
178
7.95k
      return ScenarioRunMode::kProxyTransportCoverage;
179
180
7.85k
    case TargetProfile::kResolver:
181
7.85k
      return ScenarioRunMode::kResolverCoverage;
182
183
6.10k
    case TargetProfile::kFastFtp:
184
6.10k
      return ScenarioRunMode::kFtpCoverage;
185
186
2.23k
    case TargetProfile::kFastTftp:
187
2.23k
      return ScenarioRunMode::kTftpCoverage;
188
189
4.84k
    case TargetProfile::kFastSmtp:
190
4.84k
      return ScenarioRunMode::kSmtpCoverage;
191
192
5.14k
    case TargetProfile::kFastImap:
193
5.14k
      return ScenarioRunMode::kImapCoverage;
194
195
3.82k
    case TargetProfile::kFastPop3:
196
3.82k
      return ScenarioRunMode::kPop3Coverage;
197
198
4.04k
    case TargetProfile::kFastMqtt:
199
4.04k
      return ScenarioRunMode::kMqttCoverage;
200
201
3.21k
    case TargetProfile::kFastDict:
202
3.21k
      return ScenarioRunMode::kDictCoverage;
203
204
7.56k
    case TargetProfile::kFastGopher:
205
7.56k
      return ScenarioRunMode::kGopherCoverage;
206
207
3.57k
    case TargetProfile::kFastFile:
208
3.57k
      return ScenarioRunMode::kFileCoverage;
209
210
5.76k
    case TargetProfile::kFastLdap:
211
5.76k
      return ScenarioRunMode::kLdapCoverage;
212
213
6.30k
    case TargetProfile::kFastRtsp:
214
6.30k
      return ScenarioRunMode::kRtspCoverage;
215
216
12.0k
    case TargetProfile::kCompatibility:
217
21.1k
    case TargetProfile::kFastWebSocket:
218
31.1k
    case TargetProfile::kTiming:
219
31.1k
      return ScenarioRunMode::kProtocolCoverage;
220
221
12.6k
    case TargetProfile::kDeepHttp:
222
12.6k
      return ScenarioRunMode::kDeepHttpCoverage;
223
240k
  }
224
0
  return ScenarioRunMode::kProtocolCoverage;
225
240k
}
226
227
}  // namespace proto_fuzzer
228
229
#endif  // PROTO_FUZZER_TARGET_PROFILE_H_