Limited fuzz by AFL committed, see [fuzz/README.md](fuzz/README.md) for details

lib/src/clixon_proto.c

@@ -67,6 +67,9 @@
 /* clicon */
 #include "clixon_err.h"
 #include "clixon_queue.h"
+#ifdef CLIXON_PROTO_PLAIN
+#include "clixon_event.h"
+#endif
 #include "clixon_hash.h"
 #include "clixon_handle.h"
 #include "clixon_log.h"
@@ -334,6 +337,20 @@ clicon_msg_send(int                s,
 		 __FUNCTION__, ntohl(msg->op_len));
     if (clicon_debug_get() > 2)
 	msg_dump(msg);
+#ifdef CLIXON_PROTO_PLAIN
+    {
+       cbuf *cb = NULL;
+       if ((cb = cbuf_new()) == NULL)
+           goto done;
+       cprintf(cb, "%s]]>]]>", (char*)&msg->op_body);
+       if (atomicio((ssize_t (*)(int, void *, size_t))write, 
+                    s, cbuf_get(cb), cbuf_len(cb)+1) < 0){
+           clicon_err(OE_CFG, errno, "atomicio");
+           clicon_log(LOG_WARNING, "%s: write: %s", __FUNCTION__, strerror(errno));
+           goto done;
+       }
+    }
+#else
     if (atomicio((ssize_t (*)(int, void *, size_t))write, 
 		 s, msg, ntohl(msg->op_len)) < 0){
 	clicon_err(OE_CFG, errno, "atomicio");
@@ -341,11 +358,122 @@ clicon_msg_send(int                s,
 		   strerror(errno), ntohs(msg->op_len), msg->op_body);
 	goto done;
     }
+#endif /* CLIXON_PROTO_PLAIN */
     retval = 0;
   done:
     return retval;
 }
 
+#ifdef CLIXON_PROTO_PLAIN
+/*! Receive a message using plain ascii 
+ * @see netconf_input_cb()
+ */
+static int
+clicon_msg_rcv1(int           s,
+               cbuf        **cb1,
+               int          *eof)
+{
+    int           retval = -1;
+    unsigned char buf[BUFSIZ];
+    int           i;
+    int           len;
+    cbuf         *cb=NULL;
+    int           xml_state = 0;
+    int           poll;
+
+    clicon_debug(1, "%s", __FUNCTION__);
+    if ((cb = cbuf_new()) == NULL){
+       clicon_err(OE_XML, errno, "cbuf_new");
+       return retval;
+    }
+    memset(buf, 0, sizeof(buf));
+    while (1){
+       if ((len = read(s, buf, sizeof(buf))) < 0){
+           if (errno == ECONNRESET)
+               len = 0; /* emulate EOF */
+           else{
+               clicon_log(LOG_ERR, "%s: read: %s", __FUNCTION__, strerror(errno));
+               goto done;
+           }
+       } /* read */
+       if (len == 0){  /* EOF */
+           //      cc_closed++;
+           close(s);
+           goto ok;
+       }
+       for (i=0; i<len; i++){
+           if (buf[i] == 0)
+               continue; /* Skip NULL chars (eg from terminals) */
+           cprintf(cb, "%c", buf[i]);
+           if (detect_endtag("]]>]]>",
+                             buf[i],
+                             &xml_state)) {
+               /* OK, we have an xml string from a client */
+               /* Remove trailer */
+               *(((char*)cbuf_get(cb)) + cbuf_len(cb) - strlen("]]>]]>")) = '\0';
+               *cb1 = cb;
+               clicon_debug(2, "%s", cbuf_get(cb));
+               cb = NULL;
+               goto ok;
+           }
+       }
+       /* poll==1 if more, poll==0 if none */
+       if ((poll = clixon_event_poll(s)) < 0)
+           goto done;
+       if (poll == 0)
+           break; /* No data to read */
+    } /* while */
+ ok:
+    retval = 0;
+ done:
+    clicon_debug(1, "%s done", __FUNCTION__);
+    if (cb)
+       cbuf_free(cb);
+    //    if (cc_closed) 
+    // retval = -1;
+    return retval;
+}
+
+/*! Receive a message using plain ascii 
+ * @note message is copied once too many
+ * @note session-id is made up
+ */
+static int
+clicon_msg_rcv_plain(int                s,
+                    struct clicon_msg **msg0,
+                    int                *eof)
+{ 
+    int       retval = -1;
+    cbuf      *cb = NULL;
+    size_t     sz;
+    static int ii = 0;
+    struct clicon_msg *msg = NULL;
+
+    if (clicon_msg_rcv1(s, &cb, eof) < 0)
+       goto done;
+    if (cb == NULL){
+       clicon_err(OE_CFG, EFAULT, "unrecognized input");
+       *eof = 1;
+       goto ok;
+    }
+    sz = sizeof(struct clicon_msg) + cbuf_len(cb) + 1;
+    if ((msg = (struct clicon_msg *)malloc(sz)) == NULL){
+       clicon_err(OE_CFG, errno, "malloc");
+       goto done;
+    }
+    memset(msg, 0, sz);
+    msg->op_len = htonl(sz);
+    msg->op_id = htonl(ii++); /* XXX seesion-ids are randomized */
+    strcpy((char*)&msg->op_body, cbuf_get(cb)); /* XXX message data copied */
+    cbuf_free(cb);
+    *msg0 = msg;
+ ok:
+    retval = 0;
+ done:
+    return retval;
+}
+#endif /* CLIXON_PROTO_PLAIN */
+
 /*! Receive a CLICON message
  *
  * XXX: timeout? and signals?
@@ -373,6 +501,12 @@ clicon_msg_rcv(int                s,
     sigfn_t   oldhandler;
     uint32_t  mlen;
 
+#ifdef CLIXON_PROTO_PLAIN /* for testing, eg fuzzing */
+    if (clicon_msg_rcv_plain(s, msg, eof) < 0)
+	goto done;
+    return 0;
+#endif
+
     *eof = 0;
     if (0)
 	set_signal(SIGINT, atomicio_sig_handler, &oldhandler);

lib/src/clixon_proto_client.c

@@ -168,6 +168,7 @@ clicon_rpc_msg(clicon_handle      h,
  * @param[out] session_id  Session id
  * @retval     0           OK and session_id set
  * @retval    -1           Error
+ * @note This function may send a synchronous(blocking) HELLO request to the backend as a side-effect
  */
 static int
 session_id_check(clicon_handle h,