experiments/clixon
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Limited fuzz by AFL committed, see [fuzz/README.md](fuzz/README.md) for details

Browse source
This commit is contained in:
Olof hagsand 2020-12-29 18:29:06 +01:00
parent 7f49c13eba
commit 7459925bd0
13 changed files with 276 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

134
lib/src/clixon_proto.c
View file

@ -67,6 +67,9 @@
/* clicon */
#include "clixon_err.h"
#include "clixon_queue.h"
#ifdef CLIXON_PROTO_PLAIN
#include "clixon_event.h"
#endif
#include "clixon_hash.h"
#include "clixon_handle.h"
#include "clixon_log.h"
@ -334,6 +337,20 @@ clicon_msg_send(int s,
__FUNCTION__, ntohl(msg->op_len));
if (clicon_debug_get() > 2)
msg_dump(msg);
#ifdef CLIXON_PROTO_PLAIN
{
cbuf *cb = NULL;
if ((cb = cbuf_new()) == NULL)
goto done;
cprintf(cb, "%s]]>]]>", (char*)&msg->op_body);
if (atomicio((ssize_t (*)(int, void *, size_t))write,
s, cbuf_get(cb), cbuf_len(cb)+1) < 0){
clicon_err(OE_CFG, errno, "atomicio");
clicon_log(LOG_WARNING, "%s: write: %s", __FUNCTION__, strerror(errno));
goto done;
}
}
#else
if (atomicio((ssize_t (*)(int, void *, size_t))write,
s, msg, ntohl(msg->op_len)) < 0){
clicon_err(OE_CFG, errno, "atomicio");
@ -341,11 +358,122 @@ clicon_msg_send(int s,
strerror(errno), ntohs(msg->op_len), msg->op_body);
goto done;
}
#endif /* CLIXON_PROTO_PLAIN */
retval = 0;
done:
return retval;
}
#ifdef CLIXON_PROTO_PLAIN
/*! Receive a message using plain ascii
* @see netconf_input_cb()
*/
static int
clicon_msg_rcv1(int s,
cbuf **cb1,
int *eof)
{
int retval = -1;
unsigned char buf[BUFSIZ];
int i;
int len;
cbuf *cb=NULL;
int xml_state = 0;
int poll;
clicon_debug(1, "%s", __FUNCTION__);
if ((cb = cbuf_new()) == NULL){
clicon_err(OE_XML, errno, "cbuf_new");
return retval;
}
memset(buf, 0, sizeof(buf));
while (1){
if ((len = read(s, buf, sizeof(buf))) < 0){
if (errno == ECONNRESET)
len = 0; /* emulate EOF */
else{
clicon_log(LOG_ERR, "%s: read: %s", __FUNCTION__, strerror(errno));
goto done;
}
} /* read */
if (len == 0){ /* EOF */
// cc_closed++;
close(s);
goto ok;
}
for (i=0; i<len; i++){
if (buf[i] == 0)
continue; /* Skip NULL chars (eg from terminals) */
cprintf(cb, "%c", buf[i]);
if (detect_endtag("]]>]]>",
buf[i],
&xml_state)) {
/* OK, we have an xml string from a client */
/* Remove trailer */
*(((char*)cbuf_get(cb)) + cbuf_len(cb) - strlen("]]>]]>")) = '\0';
*cb1 = cb;
clicon_debug(2, "%s", cbuf_get(cb));
cb = NULL;
goto ok;
}
}
/* poll==1 if more, poll==0 if none */
if ((poll = clixon_event_poll(s)) < 0)
goto done;
if (poll == 0)
break; /* No data to read */
} /* while */
ok:
retval = 0;
done:
clicon_debug(1, "%s done", __FUNCTION__);
if (cb)
cbuf_free(cb);
// if (cc_closed)
// retval = -1;
return retval;
}
/*! Receive a message using plain ascii
* @note message is copied once too many
* @note session-id is made up
*/
static int
clicon_msg_rcv_plain(int s,
struct clicon_msg **msg0,
int *eof)
{
int retval = -1;
cbuf *cb = NULL;
size_t sz;
static int ii = 0;
struct clicon_msg *msg = NULL;
if (clicon_msg_rcv1(s, &cb, eof) < 0)
goto done;
if (cb == NULL){
clicon_err(OE_CFG, EFAULT, "unrecognized input");
*eof = 1;
goto ok;
}
sz = sizeof(struct clicon_msg) + cbuf_len(cb) + 1;
if ((msg = (struct clicon_msg *)malloc(sz)) == NULL){
clicon_err(OE_CFG, errno, "malloc");
goto done;
}
memset(msg, 0, sz);
msg->op_len = htonl(sz);
msg->op_id = htonl(ii++); /* XXX seesion-ids are randomized */
strcpy((char*)&msg->op_body, cbuf_get(cb)); /* XXX message data copied */
cbuf_free(cb);
*msg0 = msg;
ok:
retval = 0;
done:
return retval;
}
#endif /* CLIXON_PROTO_PLAIN */
/*! Receive a CLICON message
*
* XXX: timeout? and signals?
@ -373,6 +501,12 @@ clicon_msg_rcv(int s,
sigfn_t oldhandler;
uint32_t mlen;
#ifdef CLIXON_PROTO_PLAIN /* for testing, eg fuzzing */
if (clicon_msg_rcv_plain(s, msg, eof) < 0)
goto done;
return 0;
#endif
*eof = 0;
if (0)
set_signal(SIGINT, atomicio_sig_handler, &oldhandler);