params.T1 = ntohl (mp->T1);
params.T2 = ntohl (mp->T2);
n_addresses = ntohl (mp->n_addresses);
+ /* Make sure that the number of addresses is sane */
+ if (n_addresses * sizeof (params.addresses) > vl_msg_api_max_length (mp))
+ {
+ rv = VNET_API_ERROR_INVALID_VALUE;
+ goto bad_sw_if_index;
+ }
params.addresses = 0;
if (n_addresses > 0)
vec_validate (params.addresses, n_addresses - 1);
params.T1 = ntohl (mp->T1);
params.T2 = ntohl (mp->T2);
n_prefixes = ntohl (mp->n_prefixes);
+
+ /* Minimal check to see that the number of prefixes is sane */
+ if (n_prefixes * sizeof (params.prefixes) > vl_msg_api_max_length (mp))
+ {
+ rv = VNET_API_ERROR_INVALID_VALUE;
+ goto bad_sw_if_index;
+ }
+
params.prefixes = 0;
if (n_prefixes > 0)
vec_validate (params.prefixes, n_prefixes - 1);
*/
/*
*------------------------------------------------------------------
- * pot_api.c - Proof of Transit related APIs to create
+ * pot_api.c - Proof of Transit related APIs to create
* and maintain profiles
*------------------------------------------------------------------
*/
pot_profile *profile = NULL;
u8 *name = 0;
- name = vl_api_from_api_to_new_vec(&mp->list_name);
+ name = vl_api_from_api_to_new_vec(mp, &mp->list_name);
pot_profile_list_init(name);
id = mp->id;
(void)pot_profile_set_bit_mask(profile, mp->max_bits);
} else {
rv = -3;
- }
+ }
ERROROUT:
vec_free(name);
REPLY_MACRO(VL_API_POT_PROFILE_ADD_REPLY);
u8 id;
u8 *name = NULL;
- name = vl_api_from_api_to_new_vec(&mp->list_name);
+ name = vl_api_from_api_to_new_vec(mp, &mp->list_name);
if (!pot_profile_list_is_enabled(name)) {
rv = -1;
} else {
id = mp->id;
rv = pot_profile_set_active(id);
}
-
+
vec_free(name);
REPLY_MACRO(VL_API_POT_PROFILE_ACTIVATE_REPLY);
}
add_vpp_plugin(unittest
SOURCES
+ api_fuzz_test.c
bier_test.c
bihash_test.c
bitmap_test.c
--- /dev/null
+/*
+ *------------------------------------------------------------------
+ * api_fuzz_test.c - Binary API fuzz hook
+ *
+ * Copyright (c) 2020 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *------------------------------------------------------------------
+ */
+#include <vppinfra/format.h>
+#include <vppinfra/byte_order.h>
+#include <vppinfra/error.h>
+#include <vlib/vlib.h>
+#include <vlib/unix/unix.h>
+#include <vlibapi/api.h>
+
+static u32 fuzz_seed = 0xdeaddabe;
+static u16 fuzz_first;
+static u16 fuzz_cli_first, fuzz_cli_last;
+
+extern void (*vl_msg_api_fuzz_hook) (u16, void *);
+
+static void
+fuzz_hook (u16 id, void *the_msg)
+{
+ /*
+ * Fuzz (aka screw up) this message? Leave connection establishment
+ * messages alone as well as CLI messages.
+ */
+ if ((id > fuzz_first) && !(id >= fuzz_cli_first && id < fuzz_cli_last))
+ {
+ msgbuf_t *mb;
+ u8 *limit, *start;
+
+ mb = (msgbuf_t *) (((u8 *) the_msg) - offsetof (msgbuf_t, data));
+
+ limit = (u8 *) (mb->data + ntohl (mb->data_len));
+
+ /*
+ * Leave the first 14 octets alone, aka msg_id, client_index,
+ * context, sw_if_index
+ */
+
+ start = ((u8 *) the_msg) + 14;
+
+ for (; start < limit; start++)
+ *start ^= (random_u32 (&fuzz_seed) & 0xFF);
+ }
+}
+
+static void
+default_fuzz_config (void)
+{
+ fuzz_first = vl_msg_api_get_msg_index
+ ((u8 *) "memclnt_keepalive_reply_e8d4e804");
+ fuzz_cli_first = vl_msg_api_get_msg_index ((u8 *) "cli_23bfbfff");
+ fuzz_cli_last = vl_msg_api_get_msg_index
+ ((u8 *) "cli_inband_reply_05879051");
+}
+
+static clib_error_t *
+test_api_fuzz_command_fn (vlib_main_t * vm,
+ unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+ u32 tmp;
+
+ default_fuzz_config ();
+
+ if (fuzz_first == 0xFFFF)
+ {
+ vlib_cli_output (vm, "Couldn't find 'memclnt_keepalive_reply' ID");
+ vlib_cli_output
+ (vm, "Manual setting required, use 'show api message table'");
+ }
+
+ if (fuzz_cli_first == 0xFFFF)
+ {
+ vlib_cli_output (vm, "Couldn't find 'cli' ID");
+ vlib_cli_output
+ (vm, "Manual setting required, use 'show api message table'");
+ }
+
+ if (fuzz_cli_last == 0xFFFF)
+ {
+ vlib_cli_output (vm, "Couldn't find 'cli_inband_reply' ID");
+ vlib_cli_output
+ (vm, "Manual setting required, use 'show api message table'");
+ }
+
+ while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
+ {
+ if (unformat (input, "seed %d", &fuzz_seed))
+ ;
+ else if (unformat (input, "disable") | unformat (input, "off"))
+ fuzz_first = ~0;
+ else if (unformat (input, "fuzz-first %d", &tmp))
+ fuzz_first = (u16) tmp;
+ else if (unformat (input, "fuzz-cli-first %d", &tmp))
+ fuzz_cli_first = (u16) tmp;
+ else if (unformat (input, "fuzz-cli-last %d", &tmp))
+ fuzz_cli_last = (u16) tmp;
+ else
+ break;
+ }
+
+ if (fuzz_first == 0xFFFF)
+ {
+ vl_msg_api_fuzz_hook = 0;
+ return clib_error_return (0, "fuzz_first is ~0, fuzzing disabled");
+ }
+ vl_msg_api_fuzz_hook = fuzz_hook;
+
+ vlib_cli_output (vm, "Fuzzing enabled: first %d, skip cli range %d - %d",
+ (u32) fuzz_first, (u32) fuzz_cli_first,
+ (u32) fuzz_cli_last);
+
+ return 0;
+}
+
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (test_api_fuzz, static) = {
+ .path = "test api fuzz",
+ .short_help = "test api fuzz [disable][seed nnn]\n"
+ " [fuzz-first nn][fuzz-cli-first nn][fuzz-cli-last nn]",
+ .function = test_api_fuzz_command_fn,
+ };
+/* *INDENT-ON* */
+
+static u8 main_loop_enter_enable_api_fuzz;
+
+static clib_error_t *
+api_fuzz_config (vlib_main_t * vm, unformat_input_t * input)
+{
+ while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
+ {
+ if (unformat (input, "off")
+ || unformat (input, "disable") || unformat (input, "no"))
+ ; /* ok, no action */
+ else if (unformat (input, "on")
+ || unformat (input, "enable") || unformat (input, "yes"))
+ main_loop_enter_enable_api_fuzz = 1;
+ else
+ return clib_error_return (0, "unknown input '%U'",
+ format_unformat_error, input);
+ }
+ return 0;
+}
+
+VLIB_CONFIG_FUNCTION (api_fuzz_config, "api-fuzz");
+
+static clib_error_t *
+api_fuzz_api_init (vlib_main_t * vm)
+{
+ /* Are we supposed to fuzz API messages? */
+ if (main_loop_enter_enable_api_fuzz == 0)
+ return 0;
+
+ default_fuzz_config ();
+
+ if (fuzz_first == 0xFFFF)
+ {
+ return clib_error_return
+ (0, "Couldn't find 'memclnt_keepalive_reply' ID");
+ }
+ /* Turn on fuzzing */
+ vl_msg_api_fuzz_hook = fuzz_hook;
+ return 0;
+}
+
+VLIB_API_INIT_FUNCTION (api_fuzz_api_init);
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
vam->retval = retval;
if (retval == 0)
- vam->cmd_reply = vl_api_from_api_to_new_vec (&mp->reply);
+ vam->cmd_reply = vl_api_from_api_to_new_vec (mp, &mp->reply);
vam->result_ready = 1;
}
vat_json_node_t node;
u8 *reply = 0; /* reply vector */
- reply = vl_api_from_api_to_new_vec (&mp->reply);
+ reply = vl_api_from_api_to_new_vec (mp, &mp->reply);
vec_reset_length (vam->cmd_reply);
vat_json_init_object (&node);
void *the_msg, vlib_main_t * vm,
vlib_node_runtime_t * node,
u8 is_private);
+u32 vl_msg_api_max_length (void *mp);
vl_api_trace_t *vl_msg_api_trace_get (api_main_t * am,
vl_api_trace_which_t which);
void vl_msg_api_add_msg_name_crc (api_main_t * am, const char *string,
}
}
+void (*vl_msg_api_fuzz_hook) (u16, void *);
+
/* This is only to be called from a vlib/vnet app */
void
vl_msg_api_handler_with_vm_node (api_main_t * am, svm_region_t * vlib_rp,
am->vlib_rp = vlib_rp;
am->shmem_hdr = (void *) vlib_rp->user_ctx;
}
+
+ if (PREDICT_FALSE (vl_msg_api_fuzz_hook != 0))
+ (*vl_msg_api_fuzz_hook) (id, the_msg);
+
(*handler) (the_msg, vm, node);
if (is_private)
{
vl_msg_api_handler ((void *) msg);
}
+u32
+vl_msg_api_max_length (void *mp)
+{
+ msgbuf_t *mb;
+ u32 data_len = ~0;
+
+ /* Work out the maximum sane message length, and return it */
+ if (PREDICT_TRUE (mp != 0))
+ {
+ mb = (msgbuf_t *) (((u8 *) mp) - offsetof (msgbuf_t, data));
+ data_len = clib_net_to_host_u32 (mb->data_len);
+ }
+ return data_len;
+}
+
vl_api_trace_t *
vl_msg_api_trace_get (api_main_t * am, vl_api_trace_which_t which)
{
* NOT nul terminated.
*/
u8 *
-vl_api_from_api_to_new_vec (vl_api_string_t * astr)
+vl_api_from_api_to_new_vec (void *mp, vl_api_string_t * astr)
{
u8 *v = 0;
+
+ if (vl_msg_api_max_length (mp) < clib_net_to_host_u32 (astr->length))
+ return format (0, "insane astr->length %u%c",
+ clib_net_to_host_u32 (astr->length), 0);
vec_add (v, astr->buf, clib_net_to_host_u32 (astr->length));
return v;
}
extern u32 vl_api_string_len (vl_api_string_t * astr);
/* Returns new vector. NON nul terminated */
-extern u8 * vl_api_from_api_to_new_vec (vl_api_string_t *astr);
+extern u8 * vl_api_from_api_to_new_vec (void *mp, vl_api_string_t *astr);
/* Returns new vector. Nul terminated */
extern char * vl_api_from_api_to_new_c_string (vl_api_string_t *astr);
/* If a tag was supplied... */
if (vl_api_string_len (&mp->tag))
{
- u8 *tag = vl_api_from_api_to_new_vec (&mp->tag);
+ u8 *tag = vl_api_from_api_to_new_vec (mp, &mp->tag);
vnet_set_sw_interface_tag (vnm, tag, ap->sw_if_index);
}
if (mp->name_filter_valid)
{
- filter = vl_api_from_api_to_new_vec (&mp->name_filter);
+ filter = vl_api_from_api_to_new_vec (mp, &mp->name_filter);
vec_add1 (filter, 0); /* Ensure it's a C string for strcasecmp() */
}
vl_api_ip_punt_redirect_dump_t_handler (vl_api_ip_punt_redirect_dump_t * mp)
{
vl_api_registration_t *reg;
- fib_protocol_t fproto;
+ fib_protocol_t fproto = FIB_PROTOCOL_IP4;
reg = vl_api_client_index_to_registration (mp->client_index);
if (!reg)
return;
- fproto = mp->is_ipv6 ? FIB_PROTOCOL_IP6 : FIB_PROTOCOL_IP4;
+ if (mp->is_ipv6 == 1)
+ fproto = FIB_PROTOCOL_IP6;
ip_punt_redirect_walk_ctx_t ctx = {
.reg = reg,
punt_reason_dump_walk_ctx_t ctx = {
.reg = reg,
.context = mp->context,
- .name = vl_api_from_api_to_new_vec (&mp->reason.name),
+ .name = vl_api_from_api_to_new_vec (mp, &mp->reason.name),
};
punt_reason_walk (punt_reason_dump_walk_cb, &ctx);
int rv = 0;
u8 *sys_name = 0;
- sys_name = vl_api_from_api_to_new_vec (&mp->system_name);
+ sys_name = vl_api_from_api_to_new_vec (mp, &mp->system_name);
if (lldp_cfg_set (&sys_name, ntohl (mp->tx_hold), ntohl (mp->tx_interval))
!= lldp_ok)
if (vl_api_string_len (&mp->stream_name) > 0)
{
- u8 *stream_name = vl_api_from_api_to_new_vec (&mp->stream_name);
+ u8 *stream_name = vl_api_from_api_to_new_vec (mp, &mp->stream_name);
uword *p = hash_get_mem (pg->stream_index_by_name, stream_name);
if (p)
stream_index = *p;
a->options = mp->options;
a->session_cb_vft = &session_mq_cb_vft;
- a->namespace_id = vl_api_from_api_to_new_vec (&mp->namespace_id);
+ a->namespace_id = vl_api_from_api_to_new_vec (mp, &mp->namespace_id);
if ((rv = vnet_application_attach (a)))
{
goto done;
}
- ns_id = vl_api_from_api_to_new_vec (&mp->namespace_id);
+ ns_id = vl_api_from_api_to_new_vec (mp, &mp->namespace_id);
vnet_app_namespace_add_del_args_t args = {
.ns_id = ns_id,
goto error;
}
- cmd_vec = vl_api_from_api_to_new_vec (&mp->cmd);
+ cmd_vec = vl_api_from_api_to_new_vec (mp, &mp->cmd);
unformat_init_string (&input, (char *) cmd_vec,
vl_api_string_len (&mp->cmd));
if (mp->name_filter_valid)
{
- u8 *v = vl_api_from_api_to_new_vec (&mp->name_filter);
+ u8 *v = vl_api_from_api_to_new_vec (mp, &mp->name_filter);
s = format (s, "name_filter %v ", v);
vec_free (v);
}
u8 *s;
u8 *cmd = 0;
- cmd = vl_api_from_api_to_new_vec (&mp->cmd);
+ cmd = vl_api_from_api_to_new_vec (mp, &mp->cmd);
s = format (0, "SCRIPT: exec %v ", cmd);
ck_assert_int_eq (strlen (str), strlen (cstr));
vec_free (cstr);
- vstr = vl_api_from_api_to_new_vec (&dump->payload.name_filter);
+ vstr = vl_api_from_api_to_new_vec (0 /* not really an API message */ ,
+ &dump->payload.name_filter);
ck_assert_ptr_ne (vstr, NULL);
/* Assert nul terminator NOT present */
ck_assert_int_eq (vec_len (vstr), strlen (str));
ck_assert_int_eq (strlen (str), strlen (cstr));
vec_free (cstr);
- vstr = vl_api_from_api_to_new_vec (&dump->payload.name_filter);
+ vstr = vl_api_from_api_to_new_vec (0 /* not a real api msg */ ,
+ &dump->payload.name_filter);
ck_assert_ptr_ne (vstr, NULL);
/* Assert nul terminator NOT present */
ck_assert_int_eq (vec_len (vstr), strlen (str));
else:
default_variant = ""
+ api_fuzzing = os.getenv("API_FUZZ")
+ if api_fuzzing is None:
+ api_fuzzing = 'off'
+
cls.vpp_cmdline = [cls.vpp_bin, "unix",
"{", "nodaemon", debug_cli, "full-coredump",
coredump_size, "runtime-dir", cls.tempdir, "}",
"statseg", "{", "socket-name", cls.stats_sock, "}",
"socksvr", "{", "socket-name", cls.api_sock, "}",
"node { ", default_variant, "}",
+ "api-fuzz {", api_fuzzing, "}",
"plugins",
"{", "plugin", "dpdk_plugin.so", "{", "disable",
"}", "plugin", "rdma_plugin.so", "{", "disable",