blob: 99c89e3db6e859090cfdbcfacf075ffc550cb066 [file] [log] [blame]
// Copyright 2018 The Chromium OS Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// FuzzedCommanTransceiver is a test transceiver for fuzzing TPM commands and
// responses.
#include <cstdint>
#include <fuzzer/FuzzedDataProvider.h>
#include <string>
#include <base/macros.h>
#include "trunks/command_transceiver.h"
namespace trunks {
// Provides responses based on random data consumed from FuzzedDataProvider.
class FuzzedCommandTransceiver : public CommandTransceiver {
FuzzedCommandTransceiver(FuzzedDataProvider* const data_provider,
size_t max_message_size);
// CommandTransceiver methods.
void SendCommand(const std::string& command,
const ResponseCallback& callback) override;
std::string SendCommandAndWait(const std::string& command) override;
// Builds a fuzzed TPM command.
std::string ConsumeCommand();
// Builds a fuzzed response to the provided command.
std::string ConsumeResponseForCommand(const std::string& command);
// Returns a realistic fuzzed command code.
uint32_t ConsumeCommandCode();
// Returns a realistic fuzzed response code.
uint32_t ConsumeResponseCode();
// Returns a realistic fuzzed command tag.
uint16_t ConsumeCommandTag();
// Returns fuzzed area with |qnt_handles| handles.
std::string ConsumeHandles(size_t qnt_handles);
// Returns fuzzed TPM handle.
uint32_t ConsumeHandle();
// Returns fuzzed payload for the message with header and handles area
// taking |pre_payload_size| bytes.
std::string ConsumePayload(size_t pre_payload_size);
// Returns fuzzed bool, which is true with probability |probability| %.
bool ConsumeBoolWithProbability(uint32_t probability);
// Returns a random fuzzed message.
std::string ConsumeRandomMessage();
// Returns a random uint32_t.
uint32_t ConsumeUint32();
FuzzedDataProvider* const data_provider_;
const size_t max_message_size_;
} // namespace trunks