summaryrefslogtreecommitdiffstats
path: root/src/plugins/unittest/api_fuzz_test.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/plugins/unittest/api_fuzz_test.c')
-rw-r--r--src/plugins/unittest/api_fuzz_test.c187
1 files changed, 187 insertions, 0 deletions
diff --git a/src/plugins/unittest/api_fuzz_test.c b/src/plugins/unittest/api_fuzz_test.c
new file mode 100644
index 00000000000..113835300bb
--- /dev/null
+++ b/src/plugins/unittest/api_fuzz_test.c
@@ -0,0 +1,187 @@
+/*
+ *------------------------------------------------------------------
+ * api_fuzz_test.c - Binary API fuzz hook
+ *
+ * Copyright (c) 2020 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *------------------------------------------------------------------
+ */
+#include <vppinfra/format.h>
+#include <vppinfra/byte_order.h>
+#include <vppinfra/error.h>
+#include <vlib/vlib.h>
+#include <vlib/unix/unix.h>
+#include <vlibapi/api.h>
+
+static u32 fuzz_seed = 0xdeaddabe;
+static u16 fuzz_first;
+static u16 fuzz_cli_first, fuzz_cli_last;
+
+extern void (*vl_msg_api_fuzz_hook) (u16, void *);
+
+static void
+fuzz_hook (u16 id, void *the_msg)
+{
+ /*
+ * Fuzz (aka screw up) this message? Leave connection establishment
+ * messages alone as well as CLI messages.
+ */
+ if ((id > fuzz_first) && !(id >= fuzz_cli_first && id < fuzz_cli_last))
+ {
+ msgbuf_t *mb;
+ u8 *limit, *start;
+
+ mb = (msgbuf_t *) (((u8 *) the_msg) - offsetof (msgbuf_t, data));
+
+ limit = (u8 *) (mb->data + ntohl (mb->data_len));
+
+ /*
+ * Leave the first 14 octets alone, aka msg_id, client_index,
+ * context, sw_if_index
+ */
+
+ start = ((u8 *) the_msg) + 14;
+
+ for (; start < limit; start++)
+ *start ^= (random_u32 (&fuzz_seed) & 0xFF);
+ }
+}
+
+static void
+default_fuzz_config (void)
+{
+ fuzz_first = vl_msg_api_get_msg_index
+ ((u8 *) "memclnt_keepalive_reply_e8d4e804");
+ fuzz_cli_first = vl_msg_api_get_msg_index ((u8 *) "cli_23bfbfff");
+ fuzz_cli_last = vl_msg_api_get_msg_index
+ ((u8 *) "cli_inband_reply_05879051");
+}
+
+static clib_error_t *
+test_api_fuzz_command_fn (vlib_main_t * vm,
+ unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+ u32 tmp;
+
+ default_fuzz_config ();
+
+ if (fuzz_first == 0xFFFF)
+ {
+ vlib_cli_output (vm, "Couldn't find 'memclnt_keepalive_reply' ID");
+ vlib_cli_output
+ (vm, "Manual setting required, use 'show api message table'");
+ }
+
+ if (fuzz_cli_first == 0xFFFF)
+ {
+ vlib_cli_output (vm, "Couldn't find 'cli' ID");
+ vlib_cli_output
+ (vm, "Manual setting required, use 'show api message table'");
+ }
+
+ if (fuzz_cli_last == 0xFFFF)
+ {
+ vlib_cli_output (vm, "Couldn't find 'cli_inband_reply' ID");
+ vlib_cli_output
+ (vm, "Manual setting required, use 'show api message table'");
+ }
+
+ while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
+ {
+ if (unformat (input, "seed %d", &fuzz_seed))
+ ;
+ else if (unformat (input, "disable") | unformat (input, "off"))
+ fuzz_first = ~0;
+ else if (unformat (input, "fuzz-first %d", &tmp))
+ fuzz_first = (u16) tmp;
+ else if (unformat (input, "fuzz-cli-first %d", &tmp))
+ fuzz_cli_first = (u16) tmp;
+ else if (unformat (input, "fuzz-cli-last %d", &tmp))
+ fuzz_cli_last = (u16) tmp;
+ else
+ break;
+ }
+
+ if (fuzz_first == 0xFFFF)
+ {
+ vl_msg_api_fuzz_hook = 0;
+ return clib_error_return (0, "fuzz_first is ~0, fuzzing disabled");
+ }
+ vl_msg_api_fuzz_hook = fuzz_hook;
+
+ vlib_cli_output (vm, "Fuzzing enabled: first %d, skip cli range %d - %d",
+ (u32) fuzz_first, (u32) fuzz_cli_first,
+ (u32) fuzz_cli_last);
+
+ return 0;
+}
+
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (test_api_fuzz, static) = {
+ .path = "test api fuzz",
+ .short_help = "test api fuzz [disable][seed nnn]\n"
+ " [fuzz-first nn][fuzz-cli-first nn][fuzz-cli-last nn]",
+ .function = test_api_fuzz_command_fn,
+ };
+/* *INDENT-ON* */
+
+static u8 main_loop_enter_enable_api_fuzz;
+
+static clib_error_t *
+api_fuzz_config (vlib_main_t * vm, unformat_input_t * input)
+{
+ while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
+ {
+ if (unformat (input, "off")
+ || unformat (input, "disable") || unformat (input, "no"))
+ ; /* ok, no action */
+ else if (unformat (input, "on")
+ || unformat (input, "enable") || unformat (input, "yes"))
+ main_loop_enter_enable_api_fuzz = 1;
+ else
+ return clib_error_return (0, "unknown input '%U'",
+ format_unformat_error, input);
+ }
+ return 0;
+}
+
+VLIB_CONFIG_FUNCTION (api_fuzz_config, "api-fuzz");
+
+static clib_error_t *
+api_fuzz_api_init (vlib_main_t * vm)
+{
+ /* Are we supposed to fuzz API messages? */
+ if (main_loop_enter_enable_api_fuzz == 0)
+ return 0;
+
+ default_fuzz_config ();
+
+ if (fuzz_first == 0xFFFF)
+ {
+ return clib_error_return
+ (0, "Couldn't find 'memclnt_keepalive_reply' ID");
+ }
+ /* Turn on fuzzing */
+ vl_msg_api_fuzz_hook = fuzz_hook;
+ return 0;
+}
+
+VLIB_API_INIT_FUNCTION (api_fuzz_api_init);
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */