Stub binary for fuzzing DNS resolver.

net/tools/dns_fuzz_stub/dns_fuzz_stub.cc

Index: net/tools/dns_fuzz_stub/dns_fuzz_stub.cc
diff --git a/net/tools/dns_fuzz_stub/dns_fuzz_stub.cc b/net/tools/dns_fuzz_stub/dns_fuzz_stub.cc
new file mode 100644
index 0000000000000000000000000000000000000000..9eb871ca33a6bf50815975e128bba9d9406b6d3c
--- /dev/null
+++ b/net/tools/dns_fuzz_stub/dns_fuzz_stub.cc
@@ -0,0 +1,97 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "base/time.h"
+#include "net/base/address_list.h"
+#include "net/base/dns_util.h"
+#include "net/base/io_buffer.h"
+#include "net/base/ip_endpoint.h"
+#include "net/dns/dns_protocol.h"
+#include "net/dns/dns_query.h"
+#include "net/dns/dns_response.h"
+
+static int Usage(const char* program_name) {

[cbentzel, 2012/05/25 01:53:55]

I don't think there's any hard rules against functions with static linkage in
our style guide, but a more common way of doing the same thing is to include
these in an anonymous namespace.

[Deprecated (see juliatuttle), 2012/05/30 22:23:40]

Done.

+  fprintf(stderr, "Usage: %s test_case_filename\n", program_name);
+  return 1;
+}
+
+static int InvalidTestCase(const char* program_name) {
+  fprintf(stderr, "%s: Test case format invalid\n", program_name);
+  return 2;
+}
+
+int main(int argc, char** argv) {
+  if (argc != 2)
+    return Usage(argv[0]);
+
+  const char* filename = argv[1];
+  FILE* file = fopen(filename, "r");
+  if (!file) {
+    perror("open");
+    return Usage(argv[0]);
+  }
+
+  uint16_t id;
+  char qname_dotted[net::dns_protocol::kMaxNameLength];
+  uint16_t qtype;
+
+  // You can overflow domain.  We don't really care -- this is a test program
+  // that will always be run under ASAN, and will not ship as part of Chrome.
+  if (fscanf(file, "%hu %s %hu\n", &id, qname_dotted, &qtype) < 3) {

[cbentzel, 2012/05/25 01:53:55]

I don't understand why we don't care about overflow here. Either ASAN will catch
it, or it will lead to unexpected issues. In either case, how would we be able
to distinguish that it's a problem in the test harness rather than the DNS code
itself? Seems like it would lead to too many false failures. 

+    return InvalidTestCase(argv[0]);
+  }
+
+  printf("Query: id=%hu name=%s type=%hu\n", id, qname_dotted, qtype);
+
+  unsigned int response_len;
+  if (fscanf(file, "%d ", &response_len) < 1) {
+    return InvalidTestCase(argv[0]);
+  }
+  char* response_buf = new char[response_len];
+  for (unsigned int i = 0; i < response_len; i++) {
+    if (fscanf(file, "%02hhx ", &response_buf[i]) < 1) {
+      return InvalidTestCase(argv[0]);
+    }
+  }
+
+  printf("Response: %u bytes\n", response_len);
+
+  std::string qname;
+  if (!net::DNSDomainFromDot(qname_dotted, &qname)) {
+    printf("%s: DNSDomainFromDot(%s) failed.\n", argv[0], qname_dotted);
+    return 3;
+  }
+
+  net::DnsQuery query(id, qname, qtype);
+  net::DnsResponse response;
+  memcpy(response.io_buffer()->data(), response_buf, response_len);
+
+  if (!response.InitParse(response_len, query)) {
+    printf("InitParse failed.\n");
+    return 0;
+  }
+
+  net::AddressList address_list;
+  base::TimeDelta ttl;
+  net::DnsResponse::Result result = response.ParseToAddressList(
+      &address_list, &ttl);
+  if (result != net::DnsResponse::DNS_SUCCESS) {
+    printf("ParseToAddressList failed: %d\n", result);
+    return 0;
+  }
+
+  printf("Address List:\n");
+  for (unsigned int i = 0; i < address_list.size(); i++) {
+    std::string address_str = address_list[i].ToString();
+    printf("\t%s\n", address_str.c_str());
+  }
+  printf("TTL: %d seconds\n", static_cast<int>(ttl.InSeconds()));
+
+  return 0;
+}
+