dfuzzer.c File Reference

#include <gio/gio.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <ctype.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>
#include "dfuzzer.h"
#include "introspection.h"
#include "fuzz.h"

Macros
#define	SF1   "./dfuzzer.conf"
#define	SF2   ".dfuzzer.conf"
#define	SF3   "/etc/dfuzzer.conf"

Functions
int	main (int argc, char **argv)
int	df_list_bus_names (const GDBusConnection *dcon)
int	df_is_object_on_bus (const GDBusConnection *dcon, const char *root_node)
int	df_traverse_node (const GDBusConnection *dcon, const char *root_node)
int	df_fuzz (const GDBusConnection *dcon, const char *name, const char *obj, const char *intf)
int	df_is_valid_dbus (const char *name, const char *obj, const char *intf)
int	df_open_proc_status_file (const int pid)
int	df_get_pid (const GDBusConnection *dcon)
void	df_print_process_info (int pid)
void	df_parse_parameters (int argc, char **argv)
int	df_load_suppressions (void)
void	df_print_help (const char *name)
void	df_error (const char *message, GError *error)
void	df_debug (const char *format,...)
void	df_verbose (const char *format,...)
void	df_fail (const char *format,...)

Variables
static struct fuzzing_target	target_proc = { "", "", "" }
static int	df_verbose_flag
static int	df_debug_flag
static int	df_list_names
static long	df_mem_limit
static long	df_buf_size
static char *	df_test_method
static int	df_pid = -1
static char *	df_suppression [MAXLEN]
static char *	df_supp_description [MAXLEN]
static int	df_supflg
static char *	df_execute_cmd

Macro Definition Documentation

#define SF1   "./dfuzzer.conf"

Suppression file #1

#define SF2   ".dfuzzer.conf"

Suppression file #2 (home dir)

#define SF3   "/etc/dfuzzer.conf"

Suppression file #3 (mandatory)

Function Documentation

void df_debug	(	const char *	format,
			...
	)

Prints debug message.

Parameters

format

Format string

void df_error	(	const char *	message,
		GError *	error
	)

Displays an error message.

Parameters

message	Error message which will be printed
error	Pointer on GError structure containing error specification

void df_fail	(	const char *	format,
			...
	)

Prints error message.

Parameters

format

Format string

int df_fuzz	(	const GDBusConnection *	dcon,
		const char *	name,
		const char *	obj,
		const char *	intf
	)

Controls fuzz testing of all methods of specified interface (intf) and reports results.

Parameters

dcon	D-Bus connection structure
name	D-Bus name
obj	D-Bus object path
intf	D-Bus interface

Returns

0 on success, 1 on error, 2 when testing detected any failures, 3 on warnings

int df_get_pid

(

const GDBusConnection *

dcon

)

Calls method GetConnectionUnixProcessID on the interface org.freedesktop.DBus to get process pid.

Parameters

dcon	D-Bus connection structure

Returns

Process PID on success, -1 on error

int df_is_object_on_bus	(	const GDBusConnection *	dcon,
		const char *	root_node
	)

Traverses through all objects of bus name target_proc.name and is looking for object path target_proc.obj_path

Parameters

dcon	D-Bus connection structure
root_node	Starting object path (all nodes from this object path will be traversed)

Returns

1 when obj. path target_proc.obj_path is found on bus, 0 otherwise

Information about nodes in a remote object hierarchy.

int df_is_valid_dbus	(	const char *	name,
		const char *	obj,
		const char *	intf
	)

Checks if name is valid D-Bus name, obj is valid D-Bus object path and intf is valid D-Bus interface.

Parameters

name	D-Bus name
obj	D-Bus object path
intf	D-Bus interface

Returns

1 if name, obj and intf are valid, 0 otherwise

int df_list_bus_names

(

const GDBusConnection *

dcon

)

Calls method ListNames to get all available connection names on the bus and prints them on the program output.

Parameters

dcon	D-Bus connection structure

Returns

0 on success, -1 on error

int df_load_suppressions

(

void

)

Searches target_proc.name in suppression file SF1, SF2 and SF3 (the file which is opened first is parsed). If it is found, df_suppression array is seeded with names of methods and df_supp_description is seeded with descriptions why methods are skipped (df_suppression array is used to skip methods which it contains when testing target_proc.name). Suppression file is in format: [bus_name] method1 description method2 description [bus_name2] method1 description method2 description ...

Returns

0 on success, -1 on error

int df_open_proc_status_file

(

const int

pid

)

Opens process status file.

Parameters

pid	PID - identifier of process

Returns

FD of status file on success, -1 on error

void df_parse_parameters	(	int	argc,
		char **	argv
	)

Parses program options and stores them into global variables:

• df_buf_size - Maximum buffer size for generated strings by rand module (in Bytes)
• df_mem_limit - Memory limit for tested process in kB
• df_test_method - Contains method name or NULL. When not NULL, only method with this name will be tested
• target_proc - Is of type struct fuzzing_target and is used to store bus name, object path and interface
• df_verbose_flag - Be verbose
• df_debug_flag - Include debug output
• df_supflg - If -s option is passed 1, otherwise 0
• df_execute_cmd - Command/script to execute after each method call If error occures function ends program.

  Parameters

  argc	Count of options
  argv	Pointer on strings containing options of program

void df_print_help

(

const char *

name

)

Prints help.

Parameters

name	Name of program

void df_print_process_info

(

int

pid

)

Prints process name and package to which process belongs.

Parameters

pid	PID of process Note: Any error in this function is suppressed. On error, process name and package is just not printed.

int df_traverse_node	(	const GDBusConnection *	dcon,
		const char *	root_node
	)

Traverses through all interfaces and objects of bus name target_proc.name and for each interface it calls df_fuzz() to fuzz test all its methods.

Parameters

dcon	D-Bus connection structure
root_node	Starting object path (all nodes from this object path will be traversed)

Returns

0 on success, 1 on error, 2 when testing detected any failures or warnings, 3 on warnings

Information about nodes in a remote object hierarchy.

Information about a D-Bus interface.

Return values

void df_verbose	(	const char *	format,
			...
	)

Prints verbose message.

Parameters

format

Format string

int main	(	int	argc,
		char **	argv
	)

Main function controls fuzzing.

Parameters

argc	Number of program arguments
argv	Pointer on string with program arguments

Returns

0 on success, 1 on error, 2 when testing detected any failures and/or warnings, 3 when testing detected only warnings

Variable Documentation

long df_buf_size

static

Maximum buffer size for generated strings by rand module (in Bytes)

int df_debug_flag

static

Verbose flag

char* df_execute_cmd

static

Command/Script to execute by dfuzzer after each method call. If command/script returns >0, dfuzzer prints fail message, if 0 it continues

int df_list_names

static

Option for listing names on the bus

long df_mem_limit

static

Memory limit for tested process in kB

int df_pid = -1

static

Tested process PID

int df_supflg

static

If -s option is passed 1, otherwise 0

char* df_supp_description[MAXLEN]

static

NULL terminated array of suppressed method descriptions

char* df_suppression[MAXLEN]

static

NULL terminated array of method names which will be skipped from testing

char* df_test_method

static

Contains method name or NULL. When not NULL, only method with this name will be tested (do not free - points to argv)

int df_verbose_flag

static

Debug flag

struct fuzzing_target target_proc = { "", "", "" }

static

Structure containing D-Bus name, object path and interface of process