Browse Source

Add more tweaks from teor's http fuzzing code.

Move option-manipulation code to fuzzing_common.
Nick Mathewson 7 years ago
parent
commit
56b61d1831
2 changed files with 67 additions and 23 deletions
  1. 53 23
      src/test/fuzz/fuzz_http.c
  2. 14 0
      src/test/fuzz/fuzzing_common.c

+ 53 - 23
src/test/fuzz/fuzz_http.c

@@ -16,51 +16,81 @@
 
 #include "fuzzing.h"
 
-static int mock_get_options_calls = 0;
-static or_options_t *mock_options = NULL;
-
 static void
-reset_options(or_options_t *options, int *get_options_calls)
+mock_connection_write_to_buf_impl_(const char *string, size_t len,
+                                   connection_t *conn, int zlib)
 {
-  memset(options, 0, sizeof(or_options_t));
-  options->TestingTorNetwork = 1;
-
-  *get_options_calls = 0;
+  log_debug(LD_GENERAL, "%sResponse:\n%zu\nConnection: %p\n%s\n",
+            zlib ? "Compressed " : "", len, conn, string);
 }
 
-static const or_options_t*
-mock_get_options(void)
+static int
+mock_directory_handle_command_get(dir_connection_t *conn,
+                                      const char *headers,
+                                      const char *body,
+                                      size_t body_len)
 {
-  ++mock_get_options_calls;
-  tor_assert(mock_options);
-  return mock_options;
+  (void)conn;
+
+  log_debug(LD_GENERAL, "Method:\nGET\n");
+
+  if (headers) {
+    log_debug(LD_GENERAL, "Header-Length:\n%zu\n", strlen(headers));
+    log_debug(LD_GENERAL, "Headers:\n%s\n", headers);
+
+  }
+
+  log_debug(LD_GENERAL, "Body-Length:\n%zu\n", body_len);
+  if (body) {
+    log_debug(LD_GENERAL, "Body:\n%s\n", body);
+  }
+
+  /* Always tell the caller we succeeded */
+  return 0;
 }
 
-static void
-mock_connection_write_to_buf_impl_(const char *string, size_t len,
-                                   connection_t *conn, int zlib)
+static int
+mock_directory_handle_command_post(dir_connection_t *conn,
+                                       const char *headers,
+                                       const char *body,
+                                       size_t body_len)
 {
-  log_debug(LD_GENERAL, "%sResponse:\n%zu\nConnection: %p\n%s\n",
-            zlib ? "Compressed " : "", len, conn, string);
+  (void)conn;
+
+  log_debug(LD_GENERAL, "Method:\nPOST\n");
+
+  if (headers) {
+    log_debug(LD_GENERAL, "Header-Length:\n%zu\n", strlen(headers));
+    log_debug(LD_GENERAL, "Headers:\n%s\n", headers);
+  }
+
+  log_debug(LD_GENERAL, "Body-Length:\n%zu\n", body_len);
+  if (body) {
+    log_debug(LD_GENERAL, "Body:\n%s\n", body);
+  }
+
+  /* Always tell the caller we succeeded */
+  return 0;
 }
 
 int
 fuzz_init(void)
 {
-  mock_options = tor_malloc(sizeof(or_options_t));
-  reset_options(mock_options, &mock_get_options_calls);
-  MOCK(get_options, mock_get_options);
   /* Set up fake response handler */
   MOCK(connection_write_to_buf_impl_, mock_connection_write_to_buf_impl_);
+  /* Set up the fake handler functions */
+  MOCK(directory_handle_command_get, mock_directory_handle_command_get);
+  MOCK(directory_handle_command_post, mock_directory_handle_command_post);
+
   return 0;
 }
 
 int
 fuzz_cleanup(void)
 {
-  tor_free(mock_options);
-  UNMOCK(get_options);
   UNMOCK(connection_write_to_buf_impl_);
+  UNMOCK(directory_handle_command_get);
+  UNMOCK(directory_handle_command_post);
   return 0;
 }
 

+ 14 - 0
src/test/fuzz/fuzzing_common.c

@@ -10,6 +10,13 @@
 extern const char tor_git_revision[];
 const char tor_git_revision[] = "";
 
+static or_options_t *mock_options = NULL;
+static const or_options_t *
+mock_get_options(void)
+{
+  return mock_options;
+}
+
 static int
 mock_crypto_pk_public_checksig__nocheck(const crypto_pk_t *env, char *to,
                                         size_t tolen,
@@ -116,6 +123,10 @@ main(int argc, char **argv)
   init_logging(1);
   configure_backtrace_handler(get_version());
 
+  /* set up the options. */
+  mock_options = tor_malloc(sizeof(or_options_t));
+  MOCK(get_options, mock_get_options);
+
   for (int i = 1; i < argc; ++i) {
     if (!strcmp(argv[i], "--warn")) {
       loglevel = LOG_WARN;
@@ -156,6 +167,9 @@ main(int argc, char **argv)
 
   if (fuzz_cleanup() < 0)
     abort();
+
+  tor_free(mock_options);
+  UNMOCK(get_options);
   return 0;
 }