Stub binary for fuzzing DNS resolver.

net/tools/dns_fuzz_stub/dns_fuzz_stub.cc

Index: net/tools/dns_fuzz_stub/dns_fuzz_stub.cc
diff --git a/net/tools/dns_fuzz_stub/dns_fuzz_stub.cc b/net/tools/dns_fuzz_stub/dns_fuzz_stub.cc
new file mode 100644
index 0000000000000000000000000000000000000000..ef18a16c3703c11f769f378f52cecc66a5f6e118
--- /dev/null
+++ b/net/tools/dns_fuzz_stub/dns_fuzz_stub.cc
@@ -0,0 +1,109 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "base/time.h"
+#include "net/base/address_list.h"
+#include "net/base/dns_util.h"
+#include "net/base/io_buffer.h"
+#include "net/base/ip_endpoint.h"
+#include "net/dns/dns_protocol.h"
+#include "net/dns/dns_query.h"
+#include "net/dns/dns_response.h"
+
+namespace {
+
+int Usage(const char* program_name) {
+  fprintf(stderr, "Usage: %s test_case_filename\n", program_name);
+  return 1;
+}
+
+int InvalidTestCase(const char* program_name) {
+  fprintf(stderr, "%s: Test case format invalid\n", program_name);
+  return 2;
+}
+
+// TODO(ttuttle): This should read from the file, probably in JSON.
+bool ReadTestCase(const char* filename,
+                  uint16_t* id, std::string* qname, uint16_t* qtype,
+                  size_t* resp_len, char** resp_buf) {
+  static const unsigned char resp[] = {
+    0x00, 0x00, 0x81, 0x80, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00,
+    0x01, 0x61, 0x00, 0x00, 0x01, 0x00, 0x01,
+    0x01, 0x61, 0x00, 0x00, 0x01, 0x00, 0x01,
+    0x00, 0x00, 0x00, 0xff, 0x00, 0x04, 0x0a, 0x0a, 0x0a, 0x0a };
+
+  *id = 0x0000;
+  *qname = "a";
+  *qtype = 0x0001;
+
+  *resp_len = sizeof(resp);
+  *resp_buf = new char[arraysize(resp)];
+  memcpy(*resp_buf, resp, sizeof(resp));
+
+  return true;
+}
+
+}
+
+int main(int argc, char** argv) {
+  if (argc != 2)
+    return Usage(argv[0]);
+
+  const char* filename = argv[1];
+
+  printf("Test case: %s\n", filename);

[cbentzel, 2012/05/31 19:17:13]

Should this be going to stdout or stderr? Should this be using the LOG()
facility instead, with the support for different levels of logging?

[Deprecated (see juliatuttle), 2012/05/31 21:37:19]

Moved to LOG.

+
+  uint16_t id;
+  std::string qname_dotted;
+  uint16_t qtype;
+  size_t resp_len;
+  char* resp_buf;
+
+  if (!ReadTestCase(filename,
+                    &id, &qname_dotted, &qtype,
+                    &resp_len, &resp_buf)) {
+    return InvalidTestCase(argv[0]);
+  }
+

[cbentzel, 2012/05/31 19:17:13]

You should use scoped_array or similar to hold onto resp_buf at this point so
you don't leak it. Not a huge deal given that it's a short lived program, but
I'd rather be careful.

[Deprecated (see juliatuttle), 2012/05/31 21:37:19]

Alright.  I've made a first attempt; let me know if there's a nicer way to do
it.  (I didn't want to pass the scoped_array to ReadTestCase, so I initialize it
from resp_buf after.)

+  printf("Query: id=%hu qname=%s qtype=%hu\n", id, qname_dotted.c_str(), qtype);
+  printf("Response: %d bytes\n", (int)resp_len);
+
+  std::string qname;
+  if (!net::DNSDomainFromDot(qname_dotted, &qname)) {
+    printf("%s: DNSDomainFromDot(%s) failed.\n", argv[0], qname_dotted.c_str());
+    return 3;
+  }
+
+  net::DnsQuery query(id, qname, qtype);
+  net::DnsResponse response;
+  memcpy(response.io_buffer()->data(), resp_buf, resp_len);
+
+  if (!response.InitParse(resp_len, query)) {
+    printf("InitParse failed.\n");

[cbentzel, 2012/05/31 19:17:13]

You are typically using argv[0] as a prefix for the messages. Do you want that
here as well?

[Deprecated (see juliatuttle), 2012/05/31 21:37:19]

Switched to LOG.

+    return 0;

[cbentzel, 2012/05/31 19:17:13]

Should this be a non-0 return code? 

[Deprecated (see juliatuttle), 2012/05/31 21:37:19]

No.  InitParse fails if the ID, question count, or question don't match the
query.  This is a legitimate failure case for a fuzzed packet.

+  }
+
+  net::AddressList address_list;
+  base::TimeDelta ttl;
+  net::DnsResponse::Result result = response.ParseToAddressList(
+      &address_list, &ttl);
+  if (result != net::DnsResponse::DNS_SUCCESS) {
+    printf("ParseToAddressList failed: %d\n", result);

[cbentzel, 2012/05/31 19:17:13]

Same concerns in this error block as in the InitParse case.

[Deprecated (see juliatuttle), 2012/05/31 21:37:19]

Again, this can fail if the packet is mangled.  If it fails, that's cool -- we
just have no response to print, so we note that it failed and exit cleanly.

+    return 0;
+  }
+
+  printf("Address List:\n");
+  for (unsigned int i = 0; i < address_list.size(); i++) {
+    std::string address_str = address_list[i].ToString();
+    printf("\t%s\n", address_str.c_str());
+  }
+  printf("TTL: %d seconds\n", static_cast<int>(ttl.InSeconds()));
+
+  return 0;
+}
+