Stub binary for fuzzing DNS resolver.

net/tools/dns_fuzz_stub/dns_fuzz_stub.cc

+#include <stdio.h>

[szym, 2012/05/24 19:41:02]

Add licence.

[Deprecated (see juliatuttle), 2012/05/24 21:53:35]

Done.

+#include <stdlib.h>
+#include <string.h>
+
+#include "base/time.h"
+#include "net/base/address_list.h"
+#include "net/base/dns_util.h"
+#include "net/base/io_buffer.h"
+#include "net/base/ip_endpoint.h"
+#include "net/dns/dns_protocol.h"
+#include "net/dns/dns_query.h"
+#include "net/dns/dns_response.h"
+
+using namespace net;

[szym, 2012/05/24 19:41:02]

Don't go using whole namespaces. Probably just put it in namespace net {}.
Typically, it'd be:
namespace net {
namespace {
 // your stuff
}
}

[szym, 2012/05/24 19:42:30]

Another option is to just go
using net::DnsQuery;
using net::DnsResponse;
using net::DNSDomainFromDot;

[Deprecated (see juliatuttle), 2012/05/24 21:53:35]

Will that work if the compiler is expecting to call just "main"?
I just went with specifying net:: before relevant things -- there aren't too
many.

[Deprecated (see juliatuttle), 2012/05/24 21:53:35]

Done.

+
+static int usage(const char* progn) {

[szym, 2012/05/24 19:41:02]

Preferred: "Usage". Expand |program_name|.

[Deprecated (see juliatuttle), 2012/05/24 21:53:35]

Done.

+  fprintf(stderr, "Usage: %s test_case_filename\n", progn);
+  return 1;
+}
+
+#define MAX_DOMAIN 256

[szym, 2012/05/24 19:41:02]

const unsigned kMaxDomain. If this is meant to be maximum length of DNS name,
use the constant from net::dns_protocol.

[Deprecated (see juliatuttle), 2012/05/24 21:53:35]

Done.

+
+int main(int argc, char** argv) {
+  // base::AtExitManager at_exit_manager;

[szym, 2012/05/24 19:42:30]

You probably don't need it.

[Deprecated (see juliatuttle), 2012/05/24 21:53:35]

Done.

+
+  if (argc < 1)

[Deprecated (see juliatuttle), 2012/05/24 21:53:35]

This should've been argc < 2 ;)

+    return usage(argv[0]);
+
+  const char* filename = argv[1];
+  FILE* file = fopen(filename, "r");

[szym, 2012/05/24 19:41:02]

Consider using file_util. Up to you.

+  if (!file) {
+    perror("open");
+    return usage(argv[0]);
+  }
+
+  uint16_t id;
+  char qname_dotted[MAX_DOMAIN];
+  uint16_t qtype;
+
+  /* XXX: You can overflow domain. */

[szym, 2012/05/24 19:41:02]

All comments are //.

[Deprecated (see juliatuttle), 2012/05/24 21:53:35]

Done.

+  fscanf(file, "%hu %s %hu\n", &id, qname_dotted, &qtype);

[szym, 2012/05/24 19:41:02]

Check that it worked.

[Deprecated (see juliatuttle), 2012/05/24 21:53:35]

Done.

+
+  printf("Query: id=%hu name=%s type=%hu\n", id, qname_dotted, qtype);

[szym, 2012/05/24 19:41:02]

What happens to the output? Is it automatically parsed by ClusterFuzz? Will the
harness only catch crashes?

[Deprecated (see juliatuttle), 2012/05/24 21:53:35]

The harness only catches crashes.  This is just for debugging.

+
+  unsigned int response_len;
+  fscanf(file, "%d ", &response_len);
+  char* response_buf = reinterpret_cast<char*>(malloc(response_len));

[szym, 2012/05/24 19:41:02]

No malloc. Use new.

[Deprecated (see juliatuttle), 2012/05/24 21:53:35]

Done.

+  for (unsigned int i = 0; i < response_len; i++) {
+    fscanf(file, "%02hhx ", &response_buf[i]);
+  }
+
+  printf("Response: %u bytes\n", response_len);
+
+  std::string qname;
+  if (!DNSDomainFromDot(qname_dotted, &qname)) {
+    fprintf(stderr, "DNSDomainFromDot failed.\n");
+    return 1;
+  }
+
+  DnsQuery query(id, qname, qtype);
+  DnsResponse response;
+  memcpy(response.io_buffer()->data(), response_buf, response_len);
+
+  if (!response.InitParse(response_len, query)) {
+    fprintf(stderr, "InitParse failed.\n");
+    return 1;
+  }
+
+  AddressList address_list;
+  base::TimeDelta ttl;
+  DnsResponse::Result result = response.ParseToAddressList(
+      &address_list, &ttl);
+  if (result != DnsResponse::DNS_SUCCESS) {
+    fprintf(stderr, "ParseToAddressList failed: %d\n", result);

[szym, 2012/05/24 19:41:02]

Should you return an error code here for the harness?

[Deprecated (see juliatuttle), 2012/05/24 21:53:35]

No.  This is not an error.  We're happy if it returns an error on a malformed
packet instead of crashing.

At some point, we may add code that allows test cases to specify their expected
results, but for now we're just making sure it doesn't crash.

+  }
+
+  printf("Address List: %d addresses\n", (int)address_list.size());
+  for (unsigned int i = 0; i < address_list.size(); i++) {
+    std::string address_str = address_list[i].ToString();
+    printf("\t%s\n", address_str.c_str());
+  }
+  printf("TTL: %d seconds\n", (int)ttl.InSeconds());
+
+  return 0;
+}