lib/overnet/routing/routing_table_fuzzer.cc

// Copyright 2018 The Fuchsia Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "garnet/lib/overnet/protocol/fidl.h"
#include "garnet/lib/overnet/protocol/varint.h"
#include "garnet/lib/overnet/routing/routing_table.h"
#include "garnet/lib/overnet/testing/test_timer.h"
#include "garnet/lib/overnet/testing/trace_cout.h"
#include "garnet/public/lib/fostr/fidl/fuchsia/overnet/protocol/formatting.h"

using namespace overnet;

namespace {

class RoutingTableFuzzer {
 public:
  RoutingTableFuzzer(bool log_stuff)
      : logging_(log_stuff ? new Logging(&timer_) : nullptr) {}

  bool StepTime(uint64_t micros) {
    timer_.Step(micros);
    return timer_.Now().after_epoch() != TimeDelta::PositiveInf();
  }

  void ProcessUpdate(Slice update) {
    auto parse_status =
        Decode<fuchsia::overnet::protocol::RoutingTableUpdate>(update);
    OVERNET_TRACE(INFO) << "Parse: " << parse_status;
    if (parse_status.is_error()) {
      return;
    }
    auto nodes = TakeVector(parse_status->mutable_nodes());
    auto links = TakeVector(parse_status->mutable_links());
    auto validation_status =
        routing_table_.ValidateIncomingUpdate(nodes, links);
    OVERNET_TRACE(INFO) << "Validate: " << validation_status;
    if (validation_status.is_error()) {
      return;
    }
    routing_table_.ProcessUpdate(std::move(nodes), std::move(links), true);
  }

  void GenerateUpdate() { routing_table_.GenerateUpdate(NodeId(2)); }

 private:
  TestTimer timer_;
  struct Logging {
    Logging(Timer* timer) : tracer(timer) {}
    TraceCout tracer;
    ScopedRenderer set_tracer{&tracer};
  };
  std::unique_ptr<Logging> logging_;
  RoutingTable routing_table_{NodeId(1), &timer_, false};

  template <class T>
  static std::vector<T> TakeVector(fidl::VectorPtr<T>* vec) {
    if (vec == nullptr) {
      return {};
    }
    return vec->take();
  }
};

class InputStream {
 public:
  InputStream(const uint8_t* data, size_t size)
      : cur_(data), end_(data + size) {}

  uint64_t Next64() {
    uint64_t out;
    if (!varint::Read(&cur_, end_, &out))
      out = 0;
    return out;
  }

  uint8_t NextByte() {
    if (cur_ == end_)
      return 0;
    return *cur_++;
  }

  Slice NextSlice() {
    auto len = std::min(uint64_t(1024 * 1024), Next64());
    return Slice::WithInitializerAndBorders(
        len, Border::None(), [this, len](uint8_t* p) {
          for (uint64_t i = 0; i < len; i++) {
            *p++ = NextByte();
          }
        });
  }

 private:
  const uint8_t* cur_;
  const uint8_t* end_;
};
}  // namespace

extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
  InputStream input(data, size);
  RoutingTableFuzzer fuzzer(false);
  for (;;) {
    switch (input.NextByte()) {
      default:
        // input exhausted, or unknown op-code
        return 0;
      case 1:
        if (!fuzzer.StepTime(input.Next64()))
          return 0;
        break;
      case 2:
        // Ignores failures in order to verify that the next input doesn't
        // crash.
        fuzzer.ProcessUpdate(input.NextSlice());
        break;
      case 3:
        fuzzer.GenerateUpdate();
        break;
    }
  }
}