1 | /* $Id: fuzzmastercmd.cpp 96407 2022-08-22 17:43:14Z vboxsync $ */
|
---|
2 | /** @file
|
---|
3 | * IPRT - Fuzzing framework API, master command.
|
---|
4 | */
|
---|
5 |
|
---|
6 | /*
|
---|
7 | * Copyright (C) 2018-2022 Oracle and/or its affiliates.
|
---|
8 | *
|
---|
9 | * This file is part of VirtualBox base platform packages, as
|
---|
10 | * available from https://www.virtualbox.org.
|
---|
11 | *
|
---|
12 | * This program is free software; you can redistribute it and/or
|
---|
13 | * modify it under the terms of the GNU General Public License
|
---|
14 | * as published by the Free Software Foundation, in version 3 of the
|
---|
15 | * License.
|
---|
16 | *
|
---|
17 | * This program is distributed in the hope that it will be useful, but
|
---|
18 | * WITHOUT ANY WARRANTY; without even the implied warranty of
|
---|
19 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
---|
20 | * General Public License for more details.
|
---|
21 | *
|
---|
22 | * You should have received a copy of the GNU General Public License
|
---|
23 | * along with this program; if not, see <https://www.gnu.org/licenses>.
|
---|
24 | *
|
---|
25 | * The contents of this file may alternatively be used under the terms
|
---|
26 | * of the Common Development and Distribution License Version 1.0
|
---|
27 | * (CDDL), a copy of it is provided in the "COPYING.CDDL" file included
|
---|
28 | * in the VirtualBox distribution, in which case the provisions of the
|
---|
29 | * CDDL are applicable instead of those of the GPL.
|
---|
30 | *
|
---|
31 | * You may elect to license modified versions of this file under the
|
---|
32 | * terms and conditions of either the GPL or the CDDL or both.
|
---|
33 | *
|
---|
34 | * SPDX-License-Identifier: GPL-3.0-only OR CDDL-1.0
|
---|
35 | */
|
---|
36 |
|
---|
37 |
|
---|
38 | /*********************************************************************************************************************************
|
---|
39 | * Header Files *
|
---|
40 | *********************************************************************************************************************************/
|
---|
41 | #include <iprt/fuzz.h>
|
---|
42 | #include "internal/iprt.h"
|
---|
43 |
|
---|
44 | #include <iprt/asm.h>
|
---|
45 | #include <iprt/assert.h>
|
---|
46 | #include <iprt/base64.h>
|
---|
47 | #include <iprt/buildconfig.h>
|
---|
48 | #include <iprt/ctype.h>
|
---|
49 | #include <iprt/env.h>
|
---|
50 | #include <iprt/err.h>
|
---|
51 | #include <iprt/file.h>
|
---|
52 | #include <iprt/getopt.h>
|
---|
53 | #include <iprt/json.h>
|
---|
54 | #include <iprt/list.h>
|
---|
55 | #include <iprt/mem.h>
|
---|
56 | #include <iprt/message.h>
|
---|
57 | #include <iprt/path.h>
|
---|
58 | #include <iprt/process.h>
|
---|
59 | #include <iprt/stream.h>
|
---|
60 | #include <iprt/string.h>
|
---|
61 | #include <iprt/tcp.h>
|
---|
62 | #include <iprt/thread.h>
|
---|
63 | #include <iprt/time.h>
|
---|
64 | #include <iprt/vfs.h>
|
---|
65 | #include <iprt/zip.h>
|
---|
66 |
|
---|
67 |
|
---|
68 | /**
|
---|
69 | * A running fuzzer state.
|
---|
70 | */
|
---|
71 | typedef struct RTFUZZRUN
|
---|
72 | {
|
---|
73 | /** List node. */
|
---|
74 | RTLISTNODE NdFuzzed;
|
---|
75 | /** Identifier. */
|
---|
76 | char *pszId;
|
---|
77 | /** Number of processes. */
|
---|
78 | uint32_t cProcs;
|
---|
79 | /** Target recorder flags. */
|
---|
80 | uint32_t fTgtRecFlags;
|
---|
81 | /** The fuzzing observer state handle. */
|
---|
82 | RTFUZZOBS hFuzzObs;
|
---|
83 | /** Flag whether fuzzing was started. */
|
---|
84 | bool fStarted;
|
---|
85 | /** Time when this run was created. */
|
---|
86 | RTTIME TimeCreated;
|
---|
87 | /** Millisecond timestamp when the run was created. */
|
---|
88 | uint64_t tsCreatedMs;
|
---|
89 | } RTFUZZRUN;
|
---|
90 | /** Pointer to a running fuzzer state. */
|
---|
91 | typedef RTFUZZRUN *PRTFUZZRUN;
|
---|
92 |
|
---|
93 |
|
---|
94 | /**
|
---|
95 | * Fuzzing master command state.
|
---|
96 | */
|
---|
97 | typedef struct RTFUZZCMDMASTER
|
---|
98 | {
|
---|
99 | /** List of running fuzzers. */
|
---|
100 | RTLISTANCHOR LstFuzzed;
|
---|
101 | /** The port to listen on. */
|
---|
102 | uint16_t uPort;
|
---|
103 | /** The TCP server for requests. */
|
---|
104 | PRTTCPSERVER hTcpSrv;
|
---|
105 | /** The root temp directory. */
|
---|
106 | const char *pszTmpDir;
|
---|
107 | /** The root results directory. */
|
---|
108 | const char *pszResultsDir;
|
---|
109 | /** Flag whether to shutdown. */
|
---|
110 | bool fShutdown;
|
---|
111 | /** The response message. */
|
---|
112 | char *pszResponse;
|
---|
113 | } RTFUZZCMDMASTER;
|
---|
114 | /** Pointer to a fuzzing master command state. */
|
---|
115 | typedef RTFUZZCMDMASTER *PRTFUZZCMDMASTER;
|
---|
116 |
|
---|
117 |
|
---|
118 | /**
|
---|
119 | * Wrapper around RTErrInfoSetV / RTMsgErrorV.
|
---|
120 | *
|
---|
121 | * @returns @a rc
|
---|
122 | * @param pErrInfo Extended error info.
|
---|
123 | * @param rc The return code.
|
---|
124 | * @param pszFormat The message format.
|
---|
125 | * @param ... The message format arguments.
|
---|
126 | */
|
---|
127 | static int rtFuzzCmdMasterErrorRc(PRTERRINFO pErrInfo, int rc, const char *pszFormat, ...)
|
---|
128 | {
|
---|
129 | va_list va;
|
---|
130 | va_start(va, pszFormat);
|
---|
131 | if (pErrInfo)
|
---|
132 | RTErrInfoSetV(pErrInfo, rc, pszFormat, va);
|
---|
133 | else
|
---|
134 | RTMsgErrorV(pszFormat, va);
|
---|
135 | va_end(va);
|
---|
136 | return rc;
|
---|
137 | }
|
---|
138 |
|
---|
139 |
|
---|
140 | /**
|
---|
141 | * Returns a running fuzzer state by the given ID.
|
---|
142 | *
|
---|
143 | * @returns Pointer to the running fuzzer state or NULL if not found.
|
---|
144 | * @param pThis The fuzzing master command state.
|
---|
145 | * @param pszId The ID to look for.
|
---|
146 | */
|
---|
147 | static PRTFUZZRUN rtFuzzCmdMasterGetFuzzerById(PRTFUZZCMDMASTER pThis, const char *pszId)
|
---|
148 | {
|
---|
149 | PRTFUZZRUN pIt = NULL;
|
---|
150 | RTListForEach(&pThis->LstFuzzed, pIt, RTFUZZRUN, NdFuzzed)
|
---|
151 | {
|
---|
152 | if (!RTStrCmp(pIt->pszId, pszId))
|
---|
153 | return pIt;
|
---|
154 | }
|
---|
155 |
|
---|
156 | return NULL;
|
---|
157 | }
|
---|
158 |
|
---|
159 |
|
---|
160 | #if 0 /* unused */
|
---|
161 | /**
|
---|
162 | * Processes and returns the value of the given config item in the JSON request.
|
---|
163 | *
|
---|
164 | * @returns IPRT status code.
|
---|
165 | * @param ppszStr Where to store the pointer to the string on success.
|
---|
166 | * @param pszCfgItem The config item to resolve.
|
---|
167 | * @param hJsonCfg The JSON object containing the item.
|
---|
168 | * @param pErrInfo Where to store the error information on failure, optional.
|
---|
169 | */
|
---|
170 | static int rtFuzzCmdMasterFuzzRunProcessCfgString(char **ppszStr, const char *pszCfgItem, RTJSONVAL hJsonCfg, PRTERRINFO pErrInfo)
|
---|
171 | {
|
---|
172 | int rc = RTJsonValueQueryStringByName(hJsonCfg, pszCfgItem, ppszStr);
|
---|
173 | if (RT_FAILURE(rc))
|
---|
174 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: Failed to query string value of \"%s\"", pszCfgItem);
|
---|
175 |
|
---|
176 | return rc;
|
---|
177 | }
|
---|
178 |
|
---|
179 |
|
---|
180 | /**
|
---|
181 | * Processes and returns the value of the given config item in the JSON request.
|
---|
182 | *
|
---|
183 | * @returns IPRT status code.
|
---|
184 | * @param pfVal Where to store the config value on success.
|
---|
185 | * @param pszCfgItem The config item to resolve.
|
---|
186 | * @param hJsonCfg The JSON object containing the item.
|
---|
187 | * @param pErrInfo Where to store the error information on failure, optional.
|
---|
188 | */
|
---|
189 | static int rtFuzzCmdMasterFuzzRunProcessCfgBool(bool *pfVal, const char *pszCfgItem, RTJSONVAL hJsonCfg, PRTERRINFO pErrInfo)
|
---|
190 | {
|
---|
191 | int rc = RTJsonValueQueryBooleanByName(hJsonCfg, pszCfgItem, pfVal);
|
---|
192 | if (RT_FAILURE(rc))
|
---|
193 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: Failed to query boolean value of \"%s\"", pszCfgItem);
|
---|
194 |
|
---|
195 | return rc;
|
---|
196 | }
|
---|
197 |
|
---|
198 |
|
---|
199 | /**
|
---|
200 | * Processes and returns the value of the given config item in the JSON request.
|
---|
201 | *
|
---|
202 | * @returns IPRT status code.
|
---|
203 | * @param pfVal Where to store the config value on success.
|
---|
204 | * @param pszCfgItem The config item to resolve.
|
---|
205 | * @param hJsonCfg The JSON object containing the item.
|
---|
206 | * @param fDef Default value if the item wasn't found.
|
---|
207 | * @param pErrInfo Where to store the error information on failure, optional.
|
---|
208 | */
|
---|
209 | static int rtFuzzCmdMasterFuzzRunProcessCfgBoolDef(bool *pfVal, const char *pszCfgItem, RTJSONVAL hJsonCfg, bool fDef, PRTERRINFO pErrInfo)
|
---|
210 | {
|
---|
211 | int rc = RTJsonValueQueryBooleanByName(hJsonCfg, pszCfgItem, pfVal);
|
---|
212 | if (rc == VERR_NOT_FOUND)
|
---|
213 | {
|
---|
214 | *pfVal = fDef;
|
---|
215 | rc = VINF_SUCCESS;
|
---|
216 | }
|
---|
217 | else if (RT_FAILURE(rc))
|
---|
218 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: Failed to query boolean value of \"%s\"", pszCfgItem);
|
---|
219 |
|
---|
220 | return rc;
|
---|
221 | }
|
---|
222 | #endif
|
---|
223 |
|
---|
224 |
|
---|
225 | /**
|
---|
226 | * Processes and returns the value of the given config item in the JSON request.
|
---|
227 | *
|
---|
228 | * @returns IPRT status code.
|
---|
229 | * @param pcbVal Where to store the config value on success.
|
---|
230 | * @param pszCfgItem The config item to resolve.
|
---|
231 | * @param hJsonCfg The JSON object containing the item.
|
---|
232 | * @param cbDef Default value if the item wasn't found.
|
---|
233 | * @param pErrInfo Where to store the error information on failure, optional.
|
---|
234 | */
|
---|
235 | static int rtFuzzCmdMasterFuzzRunProcessCfgSizeDef(size_t *pcbVal, const char *pszCfgItem, RTJSONVAL hJsonCfg, size_t cbDef, PRTERRINFO pErrInfo)
|
---|
236 | {
|
---|
237 | *pcbVal = cbDef; /* Make GCC 6.3.0 happy. */
|
---|
238 |
|
---|
239 | int64_t i64Val = 0;
|
---|
240 | int rc = RTJsonValueQueryIntegerByName(hJsonCfg, pszCfgItem, &i64Val);
|
---|
241 | if (rc == VERR_NOT_FOUND)
|
---|
242 | rc = VINF_SUCCESS;
|
---|
243 | else if (RT_FAILURE(rc))
|
---|
244 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: Failed to query size_t value of \"%s\"", pszCfgItem);
|
---|
245 | else if (i64Val < 0 || (size_t)i64Val != (uint64_t)i64Val)
|
---|
246 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_OUT_OF_RANGE, "JSON request malformed: Integer \"%s\" is out of range", pszCfgItem);
|
---|
247 | else
|
---|
248 | *pcbVal = (size_t)i64Val;
|
---|
249 |
|
---|
250 | return rc;
|
---|
251 | }
|
---|
252 |
|
---|
253 |
|
---|
254 | /**
|
---|
255 | * Processes and returns the value of the given config item in the JSON request.
|
---|
256 | *
|
---|
257 | * @returns IPRT status code.
|
---|
258 | * @param pcbVal Where to store the config value on success.
|
---|
259 | * @param pszCfgItem The config item to resolve.
|
---|
260 | * @param hJsonCfg The JSON object containing the item.
|
---|
261 | * @param cbDef Default value if the item wasn't found.
|
---|
262 | * @param pErrInfo Where to store the error information on failure, optional.
|
---|
263 | */
|
---|
264 | static int rtFuzzCmdMasterFuzzRunProcessCfgU32Def(uint32_t *pu32Val, const char *pszCfgItem, RTJSONVAL hJsonCfg, uint32_t u32Def, PRTERRINFO pErrInfo)
|
---|
265 | {
|
---|
266 | int64_t i64Val = 0;
|
---|
267 | int rc = RTJsonValueQueryIntegerByName(hJsonCfg, pszCfgItem, &i64Val);
|
---|
268 | if (rc == VERR_NOT_FOUND)
|
---|
269 | {
|
---|
270 | *pu32Val = u32Def;
|
---|
271 | rc = VINF_SUCCESS;
|
---|
272 | }
|
---|
273 | else if (RT_FAILURE(rc))
|
---|
274 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: Failed to query uint32_t value of \"%s\"", pszCfgItem);
|
---|
275 | else if (i64Val < 0 || (uint32_t)i64Val != (uint64_t)i64Val)
|
---|
276 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_OUT_OF_RANGE, "JSON request malformed: Integer \"%s\" is out of range", pszCfgItem);
|
---|
277 | else
|
---|
278 | *pu32Val = (uint32_t)i64Val;
|
---|
279 |
|
---|
280 | return rc;
|
---|
281 | }
|
---|
282 |
|
---|
283 |
|
---|
284 | /**
|
---|
285 | * Returns the configured input channel for the binary under test.
|
---|
286 | *
|
---|
287 | * @returns Selected input channel or RTFUZZOBSINPUTCHAN_INVALID if an error occurred.
|
---|
288 | * @param pszCfgItem The config item to resolve.
|
---|
289 | * @param hJsonCfg The JSON object containing the item.
|
---|
290 | * @param enmChanDef Default value if the item wasn't found.
|
---|
291 | * @param pErrInfo Where to store the error information on failure, optional.
|
---|
292 | */
|
---|
293 | static RTFUZZOBSINPUTCHAN rtFuzzCmdMasterFuzzRunProcessCfgGetInputChan(const char *pszCfgItem, RTJSONVAL hJsonCfg, RTFUZZOBSINPUTCHAN enmChanDef, PRTERRINFO pErrInfo)
|
---|
294 | {
|
---|
295 | RTFUZZOBSINPUTCHAN enmInputChan = RTFUZZOBSINPUTCHAN_INVALID;
|
---|
296 |
|
---|
297 | RTJSONVAL hJsonVal;
|
---|
298 | int rc = RTJsonValueQueryByName(hJsonCfg, pszCfgItem, &hJsonVal);
|
---|
299 | if (rc == VERR_NOT_FOUND)
|
---|
300 | enmInputChan = enmChanDef;
|
---|
301 | else if (RT_SUCCESS(rc))
|
---|
302 | {
|
---|
303 | const char *pszBinary = RTJsonValueGetString(hJsonVal);
|
---|
304 | if (pszBinary)
|
---|
305 | {
|
---|
306 | if (!RTStrCmp(pszBinary, "File"))
|
---|
307 | enmInputChan = RTFUZZOBSINPUTCHAN_FILE;
|
---|
308 | else if (!RTStrCmp(pszBinary, "Stdin"))
|
---|
309 | enmInputChan = RTFUZZOBSINPUTCHAN_STDIN;
|
---|
310 | else if (!RTStrCmp(pszBinary, "FuzzingAware"))
|
---|
311 | enmInputChan = RTFUZZOBSINPUTCHAN_FUZZING_AWARE_CLIENT;
|
---|
312 | else
|
---|
313 | rtFuzzCmdMasterErrorRc(pErrInfo, VERR_INVALID_PARAMETER, "JSON request malformed: \"%s\" for \"%s\" is not known", pszCfgItem, pszBinary);
|
---|
314 | }
|
---|
315 | else
|
---|
316 | rtFuzzCmdMasterErrorRc(pErrInfo, VERR_INVALID_STATE, "JSON request malformed: \"%s\" is not a string", pszCfgItem);
|
---|
317 |
|
---|
318 | RTJsonValueRelease(hJsonVal);
|
---|
319 | }
|
---|
320 | else
|
---|
321 | rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: Failed to query \"%s\"", pszCfgItem);
|
---|
322 |
|
---|
323 | return enmInputChan;
|
---|
324 | }
|
---|
325 |
|
---|
326 |
|
---|
327 | /**
|
---|
328 | * Processes binary related configs for the given fuzzing run.
|
---|
329 | *
|
---|
330 | * @returns IPRT status code.
|
---|
331 | * @param pFuzzRun The fuzzing run.
|
---|
332 | * @param hJsonRoot The root node of the JSON request.
|
---|
333 | * @param pErrInfo Where to store the error information on failure, optional.
|
---|
334 | */
|
---|
335 | static int rtFuzzCmdMasterFuzzRunProcessBinaryCfg(PRTFUZZRUN pFuzzRun, RTJSONVAL hJsonRoot, PRTERRINFO pErrInfo)
|
---|
336 | {
|
---|
337 | RTJSONVAL hJsonVal;
|
---|
338 | int rc = RTJsonValueQueryByName(hJsonRoot, "BinaryPath", &hJsonVal);
|
---|
339 | if (RT_SUCCESS(rc))
|
---|
340 | {
|
---|
341 | const char *pszBinary = RTJsonValueGetString(hJsonVal);
|
---|
342 | if (RT_LIKELY(pszBinary))
|
---|
343 | {
|
---|
344 | RTFUZZOBSINPUTCHAN enmInputChan = rtFuzzCmdMasterFuzzRunProcessCfgGetInputChan("InputChannel", hJsonRoot, RTFUZZOBSINPUTCHAN_STDIN, pErrInfo);
|
---|
345 | if (enmInputChan != RTFUZZOBSINPUTCHAN_INVALID)
|
---|
346 | {
|
---|
347 | rc = RTFuzzObsSetTestBinary(pFuzzRun->hFuzzObs, pszBinary, enmInputChan);
|
---|
348 | if (RT_FAILURE(rc))
|
---|
349 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "Failed to add the binary path for the fuzzing run");
|
---|
350 | }
|
---|
351 | }
|
---|
352 | else
|
---|
353 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_INVALID_STATE, "JSON request malformed: \"BinaryPath\" is not a string");
|
---|
354 | RTJsonValueRelease(hJsonVal);
|
---|
355 | }
|
---|
356 | else
|
---|
357 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: Failed to query value of \"BinaryPath\"");
|
---|
358 |
|
---|
359 | return rc;
|
---|
360 | }
|
---|
361 |
|
---|
362 |
|
---|
363 | /**
|
---|
364 | * Processes argument related configs for the given fuzzing run.
|
---|
365 | *
|
---|
366 | * @returns IPRT status code.
|
---|
367 | * @param pFuzzRun The fuzzing run.
|
---|
368 | * @param hJsonRoot The root node of the JSON request.
|
---|
369 | * @param pErrInfo Where to store the error information on failure, optional.
|
---|
370 | */
|
---|
371 | static int rtFuzzCmdMasterFuzzRunProcessArgCfg(PRTFUZZRUN pFuzzRun, RTJSONVAL hJsonRoot, PRTERRINFO pErrInfo)
|
---|
372 | {
|
---|
373 | RTJSONVAL hJsonValArgArray;
|
---|
374 | int rc = RTJsonValueQueryByName(hJsonRoot, "Arguments", &hJsonValArgArray);
|
---|
375 | if (RT_SUCCESS(rc))
|
---|
376 | {
|
---|
377 | unsigned cArgs = 0;
|
---|
378 | rc = RTJsonValueQueryArraySize(hJsonValArgArray, &cArgs);
|
---|
379 | if (RT_SUCCESS(rc))
|
---|
380 | {
|
---|
381 | if (cArgs > 0)
|
---|
382 | {
|
---|
383 | const char **papszArgs = (const char **)RTMemAllocZ(cArgs * sizeof(const char *));
|
---|
384 | RTJSONVAL *pahJsonVal = (RTJSONVAL *)RTMemAllocZ(cArgs * sizeof(RTJSONVAL));
|
---|
385 | if (RT_LIKELY(papszArgs && pahJsonVal))
|
---|
386 | {
|
---|
387 | unsigned idx = 0;
|
---|
388 |
|
---|
389 | for (idx = 0; idx < cArgs && RT_SUCCESS(rc); idx++)
|
---|
390 | {
|
---|
391 | rc = RTJsonValueQueryByIndex(hJsonValArgArray, idx, &pahJsonVal[idx]);
|
---|
392 | if (RT_SUCCESS(rc))
|
---|
393 | {
|
---|
394 | papszArgs[idx] = RTJsonValueGetString(pahJsonVal[idx]);
|
---|
395 | if (RT_UNLIKELY(!papszArgs[idx]))
|
---|
396 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_INVALID_STATE, "Argument %u is not a string", idx);
|
---|
397 | }
|
---|
398 | }
|
---|
399 |
|
---|
400 | if (RT_SUCCESS(rc))
|
---|
401 | {
|
---|
402 | rc = RTFuzzObsSetTestBinaryArgs(pFuzzRun->hFuzzObs, papszArgs, cArgs);
|
---|
403 | if (RT_FAILURE(rc))
|
---|
404 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "Failed to set arguments for the fuzzing run");
|
---|
405 | }
|
---|
406 |
|
---|
407 | /* Release queried values. */
|
---|
408 | while (idx > 0)
|
---|
409 | {
|
---|
410 | RTJsonValueRelease(pahJsonVal[idx - 1]);
|
---|
411 | idx--;
|
---|
412 | }
|
---|
413 | }
|
---|
414 | else
|
---|
415 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_NO_MEMORY, "Out of memory allocating memory for the argument vector");
|
---|
416 |
|
---|
417 | if (papszArgs)
|
---|
418 | RTMemFree(papszArgs);
|
---|
419 | if (pahJsonVal)
|
---|
420 | RTMemFree(pahJsonVal);
|
---|
421 | }
|
---|
422 | }
|
---|
423 | else
|
---|
424 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: \"Arguments\" is not an array");
|
---|
425 | RTJsonValueRelease(hJsonValArgArray);
|
---|
426 | }
|
---|
427 |
|
---|
428 | return rc;
|
---|
429 | }
|
---|
430 |
|
---|
431 |
|
---|
432 | /**
|
---|
433 | * Processes process environment related configs for the given fuzzing run.
|
---|
434 | *
|
---|
435 | * @returns IPRT status code.
|
---|
436 | * @param pFuzzRun The fuzzing run.
|
---|
437 | * @param hJsonRoot The root node of the JSON request.
|
---|
438 | * @param pErrInfo Where to store the error information on failure, optional.
|
---|
439 | */
|
---|
440 | static int rtFuzzCmdMasterFuzzRunProcessEnvironment(PRTFUZZRUN pFuzzRun, RTJSONVAL hJsonRoot, PRTERRINFO pErrInfo)
|
---|
441 | {
|
---|
442 | RTJSONVAL hJsonValEnv;
|
---|
443 | int rc = RTJsonValueQueryByName(hJsonRoot, "Env", &hJsonValEnv);
|
---|
444 | if (RT_SUCCESS(rc))
|
---|
445 | {
|
---|
446 | bool fReplaceEnv = false; /* false means to append everything to the default block. */
|
---|
447 |
|
---|
448 | rc = RTJsonValueQueryBooleanByName(hJsonRoot, "EnvReplace", &fReplaceEnv);
|
---|
449 | if ( RT_SUCCESS(rc)
|
---|
450 | || rc == VERR_NOT_FOUND)
|
---|
451 | {
|
---|
452 | RTJSONIT hEnvIt;
|
---|
453 | RTENV hEnv = NULL;
|
---|
454 |
|
---|
455 | if (fReplaceEnv)
|
---|
456 | rc = RTEnvCreate(&hEnv);
|
---|
457 | else
|
---|
458 | rc = RTEnvClone(&hEnv, RTENV_DEFAULT);
|
---|
459 |
|
---|
460 | if (RT_SUCCESS(rc))
|
---|
461 | {
|
---|
462 | rc = RTJsonIteratorBeginArray(hJsonValEnv, &hEnvIt);
|
---|
463 | if (RT_SUCCESS(rc))
|
---|
464 | {
|
---|
465 | do
|
---|
466 | {
|
---|
467 | RTJSONVAL hVal;
|
---|
468 | rc = RTJsonIteratorQueryValue(hEnvIt, &hVal, NULL);
|
---|
469 | if (RT_SUCCESS(rc))
|
---|
470 | {
|
---|
471 | const char *pszVar = RTJsonValueGetString(hVal);
|
---|
472 | if (RT_LIKELY(pszVar))
|
---|
473 | rc = RTEnvPutEx(hEnv, pszVar);
|
---|
474 | RTJsonValueRelease(hVal);
|
---|
475 | }
|
---|
476 | rc = RTJsonIteratorNext(hEnvIt);
|
---|
477 | } while (RT_SUCCESS(rc));
|
---|
478 |
|
---|
479 | if ( rc == VERR_JSON_IS_EMPTY
|
---|
480 | || rc == VERR_JSON_ITERATOR_END)
|
---|
481 | rc = VINF_SUCCESS;
|
---|
482 | else
|
---|
483 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: Failed to parse environment");
|
---|
484 |
|
---|
485 | RTJsonIteratorFree(hEnvIt);
|
---|
486 | }
|
---|
487 | else if (rc == VERR_JSON_IS_EMPTY)
|
---|
488 | rc = VINF_SUCCESS;
|
---|
489 | else
|
---|
490 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: \"Environment\" is not an array");
|
---|
491 |
|
---|
492 | if (RT_SUCCESS(rc))
|
---|
493 | {
|
---|
494 | rc = RTFuzzObsSetTestBinaryEnv(pFuzzRun->hFuzzObs, hEnv);
|
---|
495 | AssertRC(rc);
|
---|
496 | }
|
---|
497 | else if (hEnv)
|
---|
498 | RTEnvDestroy(hEnv);
|
---|
499 | }
|
---|
500 | else
|
---|
501 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: Failed to create environment block");
|
---|
502 | }
|
---|
503 | else
|
---|
504 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: Failed to query \"EnvReplace\"");
|
---|
505 |
|
---|
506 | RTJsonValueRelease(hJsonValEnv);
|
---|
507 | }
|
---|
508 | else if (rc == VERR_NOT_FOUND)
|
---|
509 | rc = VINF_SUCCESS; /* Just keep using the default environment. */
|
---|
510 | else
|
---|
511 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: Failed to query the \"Environment\"");
|
---|
512 |
|
---|
513 | return rc;
|
---|
514 | }
|
---|
515 |
|
---|
516 |
|
---|
517 | /**
|
---|
518 | * Processes process environment related configs for the given fuzzing run.
|
---|
519 | *
|
---|
520 | * @returns IPRT status code.
|
---|
521 | * @param pFuzzRun The fuzzing run.
|
---|
522 | * @param hJsonRoot The root node of the JSON request.
|
---|
523 | * @param pErrInfo Where to store the error information on failure, optional.
|
---|
524 | */
|
---|
525 | static int rtFuzzCmdMasterFuzzRunProcessSanitizers(PRTFUZZRUN pFuzzRun, RTJSONVAL hJsonRoot, PRTERRINFO pErrInfo)
|
---|
526 | {
|
---|
527 | RTJSONVAL hJsonValSan;
|
---|
528 | int rc = RTJsonValueQueryByName(hJsonRoot, "Sanitizers", &hJsonValSan);
|
---|
529 | if (RT_SUCCESS(rc))
|
---|
530 | {
|
---|
531 | uint32_t fSanitizers = 0;
|
---|
532 | RTJSONIT hSanIt;
|
---|
533 | rc = RTJsonIteratorBeginArray(hJsonValSan, &hSanIt);
|
---|
534 | if (RT_SUCCESS(rc))
|
---|
535 | {
|
---|
536 | do
|
---|
537 | {
|
---|
538 | RTJSONVAL hVal;
|
---|
539 | rc = RTJsonIteratorQueryValue(hSanIt, &hVal, NULL);
|
---|
540 | if (RT_SUCCESS(rc))
|
---|
541 | {
|
---|
542 | const char *pszSan = RTJsonValueGetString(hVal);
|
---|
543 | if (!RTStrICmp(pszSan, "Asan"))
|
---|
544 | fSanitizers |= RTFUZZOBS_SANITIZER_F_ASAN;
|
---|
545 | else if (!RTStrICmp(pszSan, "SanCov"))
|
---|
546 | fSanitizers |= RTFUZZOBS_SANITIZER_F_SANCOV;
|
---|
547 | else
|
---|
548 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_NOT_FOUND, "JSON request malformed: The sanitizer '%s' is not known", pszSan);
|
---|
549 | RTJsonValueRelease(hVal);
|
---|
550 | }
|
---|
551 | rc = RTJsonIteratorNext(hSanIt);
|
---|
552 | } while (RT_SUCCESS(rc));
|
---|
553 |
|
---|
554 | if ( rc == VERR_JSON_IS_EMPTY
|
---|
555 | || rc == VERR_JSON_ITERATOR_END)
|
---|
556 | rc = VINF_SUCCESS;
|
---|
557 | else
|
---|
558 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: Failed to parse sanitizers");
|
---|
559 |
|
---|
560 | RTJsonIteratorFree(hSanIt);
|
---|
561 | }
|
---|
562 | else if (rc == VERR_JSON_IS_EMPTY)
|
---|
563 | rc = VINF_SUCCESS;
|
---|
564 | else
|
---|
565 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: \"Sanitizers\" is not an array");
|
---|
566 |
|
---|
567 | if (RT_SUCCESS(rc))
|
---|
568 | {
|
---|
569 | rc = RTFuzzObsSetTestBinarySanitizers(pFuzzRun->hFuzzObs, fSanitizers);
|
---|
570 | AssertRC(rc);
|
---|
571 | }
|
---|
572 |
|
---|
573 | RTJsonValueRelease(hJsonValSan);
|
---|
574 | }
|
---|
575 | else if (rc == VERR_NOT_FOUND)
|
---|
576 | rc = VINF_SUCCESS; /* Just keep using the defaults. */
|
---|
577 | else
|
---|
578 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: Failed to query the \"Sanitizers\"");
|
---|
579 |
|
---|
580 | return rc;
|
---|
581 | }
|
---|
582 |
|
---|
583 |
|
---|
584 | /**
|
---|
585 | * Processes the given seed and adds it to the input corpus.
|
---|
586 | *
|
---|
587 | * @returns IPRT status code.
|
---|
588 | * @param hFuzzCtx The fuzzing context handle.
|
---|
589 | * @param pszCompression Compression used for the seed.
|
---|
590 | * @param pszSeed The seed as a base64 encoded string.
|
---|
591 | * @param pErrInfo Where to store the error information on failure, optional.
|
---|
592 | */
|
---|
593 | static int rtFuzzCmdMasterFuzzRunProcessSeed(RTFUZZCTX hFuzzCtx, const char *pszCompression, const char *pszSeed, PRTERRINFO pErrInfo)
|
---|
594 | {
|
---|
595 | int rc = VINF_SUCCESS;
|
---|
596 | ssize_t cbSeedDecoded = RTBase64DecodedSize(pszSeed, NULL);
|
---|
597 | if (cbSeedDecoded > 0)
|
---|
598 | {
|
---|
599 | uint8_t *pbSeedDecoded = (uint8_t *)RTMemAllocZ(cbSeedDecoded);
|
---|
600 | if (RT_LIKELY(pbSeedDecoded))
|
---|
601 | {
|
---|
602 | rc = RTBase64Decode(pszSeed, pbSeedDecoded, cbSeedDecoded, NULL, NULL);
|
---|
603 | if (RT_SUCCESS(rc))
|
---|
604 | {
|
---|
605 | /* Decompress if applicable. */
|
---|
606 | if (!RTStrICmp(pszCompression, "None"))
|
---|
607 | rc = RTFuzzCtxCorpusInputAdd(hFuzzCtx, pbSeedDecoded, cbSeedDecoded);
|
---|
608 | else
|
---|
609 | {
|
---|
610 | RTVFSIOSTREAM hVfsIosSeed;
|
---|
611 | rc = RTVfsIoStrmFromBuffer(RTFILE_O_READ, pbSeedDecoded, cbSeedDecoded, &hVfsIosSeed);
|
---|
612 | if (RT_SUCCESS(rc))
|
---|
613 | {
|
---|
614 | RTVFSIOSTREAM hVfsDecomp = NIL_RTVFSIOSTREAM;
|
---|
615 |
|
---|
616 | if (!RTStrICmp(pszCompression, "Gzip"))
|
---|
617 | rc = RTZipGzipDecompressIoStream(hVfsIosSeed, RTZIPGZIPDECOMP_F_ALLOW_ZLIB_HDR, &hVfsDecomp);
|
---|
618 | else
|
---|
619 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_INVALID_STATE, "Request error: Compression \"%s\" is not known", pszCompression);
|
---|
620 |
|
---|
621 | if (RT_SUCCESS(rc))
|
---|
622 | {
|
---|
623 | RTVFSFILE hVfsFile;
|
---|
624 | rc = RTVfsMemFileCreate(hVfsDecomp, 2 * _1M, &hVfsFile);
|
---|
625 | if (RT_SUCCESS(rc))
|
---|
626 | {
|
---|
627 | rc = RTVfsFileSeek(hVfsFile, 0, RTFILE_SEEK_BEGIN, NULL);
|
---|
628 | if (RT_SUCCESS(rc))
|
---|
629 | {
|
---|
630 | /* The VFS file contains the buffer for the seed now. */
|
---|
631 | rc = RTFuzzCtxCorpusInputAddFromVfsFile(hFuzzCtx, hVfsFile);
|
---|
632 | if (RT_FAILURE(rc))
|
---|
633 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "Request error: Failed to add input seed");
|
---|
634 | RTVfsFileRelease(hVfsFile);
|
---|
635 | }
|
---|
636 | else
|
---|
637 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_INVALID_STATE, "Request error: Failed to seek to the beginning of the seed");
|
---|
638 | }
|
---|
639 | else
|
---|
640 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_INVALID_STATE, "Request error: Failed to decompress input seed");
|
---|
641 |
|
---|
642 | RTVfsIoStrmRelease(hVfsDecomp);
|
---|
643 | }
|
---|
644 |
|
---|
645 | RTVfsIoStrmRelease(hVfsIosSeed);
|
---|
646 | }
|
---|
647 | else
|
---|
648 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "Request error: Failed to create I/O stream from seed buffer");
|
---|
649 | }
|
---|
650 | }
|
---|
651 | else
|
---|
652 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "Request error: Failed to decode the seed string");
|
---|
653 |
|
---|
654 | RTMemFree(pbSeedDecoded);
|
---|
655 | }
|
---|
656 | else
|
---|
657 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_NO_MEMORY, "Request error: Failed to allocate %zd bytes of memory for the seed", cbSeedDecoded);
|
---|
658 | }
|
---|
659 | else
|
---|
660 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_INVALID_STATE, "JSON request malformed: Couldn't find \"Seed\" doesn't contain a base64 encoded value");
|
---|
661 |
|
---|
662 | return rc;
|
---|
663 | }
|
---|
664 |
|
---|
665 |
|
---|
666 | /**
|
---|
667 | * Processes a signle input seed for the given fuzzing run.
|
---|
668 | *
|
---|
669 | * @returns IPRT status code.
|
---|
670 | * @param pFuzzRun The fuzzing run.
|
---|
671 | * @param hJsonSeed The seed node of the JSON request.
|
---|
672 | * @param pErrInfo Where to store the error information on failure, optional.
|
---|
673 | */
|
---|
674 | static int rtFuzzCmdMasterFuzzRunProcessInputSeedSingle(PRTFUZZRUN pFuzzRun, RTJSONVAL hJsonSeed, PRTERRINFO pErrInfo)
|
---|
675 | {
|
---|
676 | RTFUZZCTX hFuzzCtx;
|
---|
677 | int rc = RTFuzzObsQueryCtx(pFuzzRun->hFuzzObs, &hFuzzCtx);
|
---|
678 | if (RT_SUCCESS(rc))
|
---|
679 | {
|
---|
680 | RTJSONVAL hJsonValComp;
|
---|
681 | rc = RTJsonValueQueryByName(hJsonSeed, "Compression", &hJsonValComp);
|
---|
682 | if (RT_SUCCESS(rc))
|
---|
683 | {
|
---|
684 | const char *pszCompression = RTJsonValueGetString(hJsonValComp);
|
---|
685 | if (RT_LIKELY(pszCompression))
|
---|
686 | {
|
---|
687 | RTJSONVAL hJsonValSeed;
|
---|
688 | rc = RTJsonValueQueryByName(hJsonSeed, "Seed", &hJsonValSeed);
|
---|
689 | if (RT_SUCCESS(rc))
|
---|
690 | {
|
---|
691 | const char *pszSeed = RTJsonValueGetString(hJsonValSeed);
|
---|
692 | if (RT_LIKELY(pszSeed))
|
---|
693 | rc = rtFuzzCmdMasterFuzzRunProcessSeed(hFuzzCtx, pszCompression, pszSeed, pErrInfo);
|
---|
694 | else
|
---|
695 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_INVALID_STATE, "JSON request malformed: \"Seed\" value is not a string");
|
---|
696 |
|
---|
697 | RTJsonValueRelease(hJsonValSeed);
|
---|
698 | }
|
---|
699 | else
|
---|
700 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: Couldn't find \"Seed\" value");
|
---|
701 | }
|
---|
702 | else
|
---|
703 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_INVALID_STATE, "JSON request malformed: \"Compression\" value is not a string");
|
---|
704 |
|
---|
705 | RTJsonValueRelease(hJsonValComp);
|
---|
706 | }
|
---|
707 | else
|
---|
708 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: Couldn't find \"Compression\" value");
|
---|
709 |
|
---|
710 | RTFuzzCtxRelease(hFuzzCtx);
|
---|
711 | }
|
---|
712 | else
|
---|
713 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "Failed to query fuzzing context from observer");
|
---|
714 |
|
---|
715 | return rc;
|
---|
716 | }
|
---|
717 |
|
---|
718 |
|
---|
719 | /**
|
---|
720 | * Processes the given seed file and adds it to the input corpus.
|
---|
721 | *
|
---|
722 | * @returns IPRT status code.
|
---|
723 | * @param hFuzzCtx The fuzzing context handle.
|
---|
724 | * @param pszCompression Compression used for the seed.
|
---|
725 | * @param pszSeed The seed as a base64 encoded string.
|
---|
726 | * @param pErrInfo Where to store the error information on failure, optional.
|
---|
727 | */
|
---|
728 | static int rtFuzzCmdMasterFuzzRunProcessSeedFile(RTFUZZCTX hFuzzCtx, const char *pszCompression, const char *pszFile, PRTERRINFO pErrInfo)
|
---|
729 | {
|
---|
730 | int rc = VINF_SUCCESS;
|
---|
731 |
|
---|
732 | /* Decompress if applicable. */
|
---|
733 | if (!RTStrICmp(pszCompression, "None"))
|
---|
734 | rc = RTFuzzCtxCorpusInputAddFromFile(hFuzzCtx, pszFile);
|
---|
735 | else
|
---|
736 | {
|
---|
737 | RTVFSIOSTREAM hVfsIosSeed;
|
---|
738 | rc = RTVfsIoStrmOpenNormal(pszFile, RTFILE_O_OPEN | RTFILE_O_READ, &hVfsIosSeed);
|
---|
739 | if (RT_SUCCESS(rc))
|
---|
740 | {
|
---|
741 | RTVFSIOSTREAM hVfsDecomp = NIL_RTVFSIOSTREAM;
|
---|
742 |
|
---|
743 | if (!RTStrICmp(pszCompression, "Gzip"))
|
---|
744 | rc = RTZipGzipDecompressIoStream(hVfsIosSeed, RTZIPGZIPDECOMP_F_ALLOW_ZLIB_HDR, &hVfsDecomp);
|
---|
745 | else
|
---|
746 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_INVALID_STATE, "Request error: Compression \"%s\" is not known", pszCompression);
|
---|
747 |
|
---|
748 | if (RT_SUCCESS(rc))
|
---|
749 | {
|
---|
750 | RTVFSFILE hVfsFile;
|
---|
751 | rc = RTVfsMemFileCreate(hVfsDecomp, 2 * _1M, &hVfsFile);
|
---|
752 | if (RT_SUCCESS(rc))
|
---|
753 | {
|
---|
754 | rc = RTVfsFileSeek(hVfsFile, 0, RTFILE_SEEK_BEGIN, NULL);
|
---|
755 | if (RT_SUCCESS(rc))
|
---|
756 | {
|
---|
757 | /* The VFS file contains the buffer for the seed now. */
|
---|
758 | rc = RTFuzzCtxCorpusInputAddFromVfsFile(hFuzzCtx, hVfsFile);
|
---|
759 | if (RT_FAILURE(rc))
|
---|
760 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "Request error: Failed to add input seed");
|
---|
761 | RTVfsFileRelease(hVfsFile);
|
---|
762 | }
|
---|
763 | else
|
---|
764 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_INVALID_STATE, "Request error: Failed to seek to the beginning of the seed");
|
---|
765 | }
|
---|
766 | else
|
---|
767 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_INVALID_STATE, "Request error: Failed to decompress input seed");
|
---|
768 |
|
---|
769 | RTVfsIoStrmRelease(hVfsDecomp);
|
---|
770 | }
|
---|
771 |
|
---|
772 | RTVfsIoStrmRelease(hVfsIosSeed);
|
---|
773 | }
|
---|
774 | else
|
---|
775 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "Request error: Failed to create I/O stream from seed buffer");
|
---|
776 | }
|
---|
777 |
|
---|
778 | return rc;
|
---|
779 | }
|
---|
780 |
|
---|
781 |
|
---|
782 | /**
|
---|
783 | * Processes a signle input seed given as a file path for the given fuzzing run.
|
---|
784 | *
|
---|
785 | * @returns IPRT status code.
|
---|
786 | * @param pFuzzRun The fuzzing run.
|
---|
787 | * @param hJsonSeed The seed node of the JSON request.
|
---|
788 | * @param pErrInfo Where to store the error information on failure, optional.
|
---|
789 | */
|
---|
790 | static int rtFuzzCmdMasterFuzzRunProcessInputSeedFileSingle(PRTFUZZRUN pFuzzRun, RTJSONVAL hJsonSeed, PRTERRINFO pErrInfo)
|
---|
791 | {
|
---|
792 | RTFUZZCTX hFuzzCtx;
|
---|
793 | int rc = RTFuzzObsQueryCtx(pFuzzRun->hFuzzObs, &hFuzzCtx);
|
---|
794 | if (RT_SUCCESS(rc))
|
---|
795 | {
|
---|
796 | RTJSONVAL hJsonValComp;
|
---|
797 | rc = RTJsonValueQueryByName(hJsonSeed, "Compression", &hJsonValComp);
|
---|
798 | if (RT_SUCCESS(rc))
|
---|
799 | {
|
---|
800 | const char *pszCompression = RTJsonValueGetString(hJsonValComp);
|
---|
801 | if (RT_LIKELY(pszCompression))
|
---|
802 | {
|
---|
803 | RTJSONVAL hJsonValFile;
|
---|
804 | rc = RTJsonValueQueryByName(hJsonSeed, "File", &hJsonValFile);
|
---|
805 | if (RT_SUCCESS(rc))
|
---|
806 | {
|
---|
807 | const char *pszFile = RTJsonValueGetString(hJsonValFile);
|
---|
808 | if (RT_LIKELY(pszFile))
|
---|
809 | rc = rtFuzzCmdMasterFuzzRunProcessSeedFile(hFuzzCtx, pszCompression, pszFile, pErrInfo);
|
---|
810 | else
|
---|
811 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_INVALID_STATE, "JSON request malformed: \"File\" value is not a string");
|
---|
812 |
|
---|
813 | RTJsonValueRelease(hJsonValFile);
|
---|
814 | }
|
---|
815 | else
|
---|
816 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: Couldn't find \"File\" value");
|
---|
817 | }
|
---|
818 | else
|
---|
819 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_INVALID_STATE, "JSON request malformed: \"Compression\" value is not a string");
|
---|
820 |
|
---|
821 | RTJsonValueRelease(hJsonValComp);
|
---|
822 | }
|
---|
823 | else
|
---|
824 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: Couldn't find \"Compression\" value");
|
---|
825 |
|
---|
826 | RTFuzzCtxRelease(hFuzzCtx);
|
---|
827 | }
|
---|
828 | else
|
---|
829 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "Failed to query fuzzing context from observer");
|
---|
830 |
|
---|
831 | return rc;
|
---|
832 | }
|
---|
833 |
|
---|
834 |
|
---|
835 | /**
|
---|
836 | * Processes input seed related configs for the given fuzzing run.
|
---|
837 | *
|
---|
838 | * @returns IPRT status code.
|
---|
839 | * @param pFuzzRun The fuzzing run.
|
---|
840 | * @param hJsonRoot The root node of the JSON request.
|
---|
841 | * @param pErrInfo Where to store the error information on failure, optional.
|
---|
842 | */
|
---|
843 | static int rtFuzzCmdMasterFuzzRunProcessInputSeeds(PRTFUZZRUN pFuzzRun, RTJSONVAL hJsonRoot, PRTERRINFO pErrInfo)
|
---|
844 | {
|
---|
845 | RTJSONVAL hJsonValSeedArray;
|
---|
846 | int rc = RTJsonValueQueryByName(hJsonRoot, "InputSeeds", &hJsonValSeedArray);
|
---|
847 | if (RT_SUCCESS(rc))
|
---|
848 | {
|
---|
849 | RTJSONIT hIt;
|
---|
850 | rc = RTJsonIteratorBegin(hJsonValSeedArray, &hIt);
|
---|
851 | if (RT_SUCCESS(rc))
|
---|
852 | {
|
---|
853 | RTJSONVAL hJsonInpSeed;
|
---|
854 | while ( RT_SUCCESS(rc)
|
---|
855 | && RTJsonIteratorQueryValue(hIt, &hJsonInpSeed, NULL) != VERR_JSON_ITERATOR_END)
|
---|
856 | {
|
---|
857 | rc = rtFuzzCmdMasterFuzzRunProcessInputSeedSingle(pFuzzRun, hJsonInpSeed, pErrInfo);
|
---|
858 | RTJsonValueRelease(hJsonInpSeed);
|
---|
859 | if (RT_FAILURE(rc))
|
---|
860 | break;
|
---|
861 | rc = RTJsonIteratorNext(hIt);
|
---|
862 | }
|
---|
863 |
|
---|
864 | if (rc == VERR_JSON_ITERATOR_END)
|
---|
865 | rc = VINF_SUCCESS;
|
---|
866 | }
|
---|
867 | else
|
---|
868 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: Failed to create array iterator");
|
---|
869 |
|
---|
870 | RTJsonValueRelease(hJsonValSeedArray);
|
---|
871 | }
|
---|
872 | else if (rc == VERR_NOT_FOUND)
|
---|
873 | rc = VINF_SUCCESS;
|
---|
874 |
|
---|
875 | if (RT_SUCCESS(rc))
|
---|
876 | {
|
---|
877 | rc = RTJsonValueQueryByName(hJsonRoot, "InputSeedFiles", &hJsonValSeedArray);
|
---|
878 | if (RT_SUCCESS(rc))
|
---|
879 | {
|
---|
880 | RTJSONIT hIt;
|
---|
881 | rc = RTJsonIteratorBegin(hJsonValSeedArray, &hIt);
|
---|
882 | if (RT_SUCCESS(rc))
|
---|
883 | {
|
---|
884 | RTJSONVAL hJsonInpSeed;
|
---|
885 | while ( RT_SUCCESS(rc)
|
---|
886 | && RTJsonIteratorQueryValue(hIt, &hJsonInpSeed, NULL) != VERR_JSON_ITERATOR_END)
|
---|
887 | {
|
---|
888 | rc = rtFuzzCmdMasterFuzzRunProcessInputSeedFileSingle(pFuzzRun, hJsonInpSeed, pErrInfo);
|
---|
889 | RTJsonValueRelease(hJsonInpSeed);
|
---|
890 | if (RT_FAILURE(rc))
|
---|
891 | break;
|
---|
892 | rc = RTJsonIteratorNext(hIt);
|
---|
893 | }
|
---|
894 |
|
---|
895 | if (rc == VERR_JSON_ITERATOR_END)
|
---|
896 | rc = VINF_SUCCESS;
|
---|
897 | }
|
---|
898 | else
|
---|
899 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: Failed to create array iterator");
|
---|
900 |
|
---|
901 | RTJsonValueRelease(hJsonValSeedArray);
|
---|
902 | }
|
---|
903 | else if (rc == VERR_NOT_FOUND)
|
---|
904 | rc = VINF_SUCCESS;
|
---|
905 | }
|
---|
906 |
|
---|
907 | return rc;
|
---|
908 | }
|
---|
909 |
|
---|
910 |
|
---|
911 | /**
|
---|
912 | * Processes miscellaneous config items.
|
---|
913 | *
|
---|
914 | * @returns IPRT status code.
|
---|
915 | * @param pFuzzRun The fuzzing run.
|
---|
916 | * @param hJsonRoot The root node of the JSON request.
|
---|
917 | * @param pErrInfo Where to store the error information on failure, optional.
|
---|
918 | */
|
---|
919 | static int rtFuzzCmdMasterFuzzRunProcessMiscCfg(PRTFUZZRUN pFuzzRun, RTJSONVAL hJsonRoot, PRTERRINFO pErrInfo)
|
---|
920 | {
|
---|
921 | size_t cbTmp;
|
---|
922 | int rc = rtFuzzCmdMasterFuzzRunProcessCfgSizeDef(&cbTmp, "InputSeedMax", hJsonRoot, 0, pErrInfo);
|
---|
923 | if (RT_SUCCESS(rc))
|
---|
924 | {
|
---|
925 | RTFUZZCTX hFuzzCtx;
|
---|
926 | rc = RTFuzzObsQueryCtx(pFuzzRun->hFuzzObs, &hFuzzCtx);
|
---|
927 | AssertRC(rc);
|
---|
928 |
|
---|
929 | rc = RTFuzzCtxCfgSetInputSeedMaximum(hFuzzCtx, cbTmp);
|
---|
930 | if (RT_FAILURE(rc))
|
---|
931 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "Request error: Failed to set maximum input seed size to %zu", cbTmp);
|
---|
932 | }
|
---|
933 |
|
---|
934 | if (RT_SUCCESS(rc))
|
---|
935 | rc = rtFuzzCmdMasterFuzzRunProcessCfgU32Def(&pFuzzRun->cProcs, "FuzzingProcs", hJsonRoot, 0, pErrInfo);
|
---|
936 | if (RT_SUCCESS(rc))
|
---|
937 | {
|
---|
938 | uint32_t msTimeoutMax = 0;
|
---|
939 | rc = rtFuzzCmdMasterFuzzRunProcessCfgU32Def(&msTimeoutMax, "TimeoutMax", hJsonRoot, 1000, pErrInfo);
|
---|
940 | if (RT_SUCCESS(rc))
|
---|
941 | rc = RTFuzzObsSetTestBinaryTimeout(pFuzzRun->hFuzzObs, msTimeoutMax);
|
---|
942 | }
|
---|
943 |
|
---|
944 | return rc;
|
---|
945 | }
|
---|
946 |
|
---|
947 |
|
---|
948 | /**
|
---|
949 | * Processes target recording related configs for the given fuzzing run.
|
---|
950 | *
|
---|
951 | * @returns IPRT status code.
|
---|
952 | * @param pFuzzRun The fuzzing run.
|
---|
953 | * @param hJsonRoot The root node of the JSON request.
|
---|
954 | * @param pErrInfo Where to store the error information on failure, optional.
|
---|
955 | */
|
---|
956 | static int rtFuzzCmdMasterFuzzRunProcessTgtRecFlags(PRTFUZZRUN pFuzzRun, RTJSONVAL hJsonRoot, PRTERRINFO pErrInfo)
|
---|
957 | {
|
---|
958 | RTJSONVAL hJsonValTgt;
|
---|
959 | int rc = RTJsonValueQueryByName(hJsonRoot, "TgtRec", &hJsonValTgt);
|
---|
960 | if (RT_SUCCESS(rc))
|
---|
961 | {
|
---|
962 | uint32_t fTgtRecFlags = 0;
|
---|
963 | RTJSONIT hTgtIt;
|
---|
964 | rc = RTJsonIteratorBeginArray(hJsonValTgt, &hTgtIt);
|
---|
965 | if (RT_SUCCESS(rc))
|
---|
966 | {
|
---|
967 | do
|
---|
968 | {
|
---|
969 | RTJSONVAL hVal;
|
---|
970 | rc = RTJsonIteratorQueryValue(hTgtIt, &hVal, NULL);
|
---|
971 | if (RT_SUCCESS(rc))
|
---|
972 | {
|
---|
973 | const char *pszTgtRec = RTJsonValueGetString(hVal);
|
---|
974 | if (!RTStrICmp(pszTgtRec, "StdOut"))
|
---|
975 | fTgtRecFlags |= RTFUZZTGT_REC_STATE_F_STDOUT;
|
---|
976 | else if (!RTStrICmp(pszTgtRec, "StdErr"))
|
---|
977 | fTgtRecFlags |= RTFUZZTGT_REC_STATE_F_STDERR;
|
---|
978 | else if (!RTStrICmp(pszTgtRec, "ProcSts"))
|
---|
979 | fTgtRecFlags |= RTFUZZTGT_REC_STATE_F_PROCSTATUS;
|
---|
980 | else if (!RTStrICmp(pszTgtRec, "SanCov"))
|
---|
981 | fTgtRecFlags |= RTFUZZTGT_REC_STATE_F_SANCOV;
|
---|
982 | else
|
---|
983 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_NOT_FOUND, "JSON request malformed: The recording flags '%s' is not known", pszTgtRec);
|
---|
984 | RTJsonValueRelease(hVal);
|
---|
985 | }
|
---|
986 | rc = RTJsonIteratorNext(hTgtIt);
|
---|
987 | } while (RT_SUCCESS(rc));
|
---|
988 |
|
---|
989 | if ( rc == VERR_JSON_IS_EMPTY
|
---|
990 | || rc == VERR_JSON_ITERATOR_END)
|
---|
991 | rc = VINF_SUCCESS;
|
---|
992 | else
|
---|
993 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: Failed to parse target recording flags");
|
---|
994 |
|
---|
995 | RTJsonIteratorFree(hTgtIt);
|
---|
996 | }
|
---|
997 | else if (rc == VERR_JSON_IS_EMPTY)
|
---|
998 | rc = VINF_SUCCESS;
|
---|
999 | else
|
---|
1000 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: \"TgtRec\" is not an array");
|
---|
1001 |
|
---|
1002 | pFuzzRun->fTgtRecFlags = fTgtRecFlags;
|
---|
1003 |
|
---|
1004 | RTJsonValueRelease(hJsonValTgt);
|
---|
1005 | }
|
---|
1006 | else if (rc == VERR_NOT_FOUND)
|
---|
1007 | {
|
---|
1008 | pFuzzRun->fTgtRecFlags = RTFUZZTGT_REC_STATE_F_PROCSTATUS;
|
---|
1009 | rc = VINF_SUCCESS; /* Just keep using the defaults. */
|
---|
1010 | }
|
---|
1011 | else
|
---|
1012 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: Failed to query \"TgtRec\"");
|
---|
1013 |
|
---|
1014 | return rc;
|
---|
1015 | }
|
---|
1016 |
|
---|
1017 |
|
---|
1018 | /**
|
---|
1019 | * Sets up the directories for the given fuzzing run.
|
---|
1020 | *
|
---|
1021 | * @returns IPRT status code.
|
---|
1022 | * @param pThis The fuzzing master command state.
|
---|
1023 | * @param pFuzzRun The fuzzing run to setup the directories for.
|
---|
1024 | * @param pErrInfo Where to store the error information on failure, optional.
|
---|
1025 | */
|
---|
1026 | static int rtFuzzCmdMasterFuzzRunSetupDirectories(PRTFUZZCMDMASTER pThis, PRTFUZZRUN pFuzzRun, PRTERRINFO pErrInfo)
|
---|
1027 | {
|
---|
1028 | /* Create temp directories. */
|
---|
1029 | char szTmpDir[RTPATH_MAX];
|
---|
1030 | int rc = RTPathJoin(&szTmpDir[0], sizeof(szTmpDir), pThis->pszTmpDir, pFuzzRun->pszId);
|
---|
1031 | AssertRC(rc);
|
---|
1032 | rc = RTDirCreate(szTmpDir, 0700, RTDIRCREATE_FLAGS_NOT_CONTENT_INDEXED_SET
|
---|
1033 | | RTDIRCREATE_FLAGS_NOT_CONTENT_INDEXED_NOT_CRITICAL);
|
---|
1034 | if (rc == VERR_ALREADY_EXISTS)
|
---|
1035 | {
|
---|
1036 | /* Clear the directory. */
|
---|
1037 | rc = RTDirRemoveRecursive(szTmpDir, RTDIRRMREC_F_CONTENT_ONLY);
|
---|
1038 | }
|
---|
1039 |
|
---|
1040 | if (RT_SUCCESS(rc))
|
---|
1041 | {
|
---|
1042 | rc = RTFuzzObsSetTmpDirectory(pFuzzRun->hFuzzObs, szTmpDir);
|
---|
1043 | if (RT_SUCCESS(rc))
|
---|
1044 | {
|
---|
1045 | rc = RTPathJoin(&szTmpDir[0], sizeof(szTmpDir), pThis->pszResultsDir, pFuzzRun->pszId);
|
---|
1046 | AssertRC(rc);
|
---|
1047 | rc = RTDirCreate(szTmpDir, 0700, RTDIRCREATE_FLAGS_NOT_CONTENT_INDEXED_SET
|
---|
1048 | | RTDIRCREATE_FLAGS_NOT_CONTENT_INDEXED_NOT_CRITICAL);
|
---|
1049 | if (RT_SUCCESS(rc) || rc == VERR_ALREADY_EXISTS)
|
---|
1050 | {
|
---|
1051 | rc = RTFuzzObsSetResultDirectory(pFuzzRun->hFuzzObs, szTmpDir);
|
---|
1052 | if (RT_FAILURE(rc))
|
---|
1053 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "Request error: Failed to set results directory to %s", szTmpDir);
|
---|
1054 | }
|
---|
1055 | else
|
---|
1056 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "Request error: Failed to create results directory %s", szTmpDir);
|
---|
1057 | }
|
---|
1058 | else
|
---|
1059 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "Request error: Failed to set temporary directory to %s", szTmpDir);
|
---|
1060 | }
|
---|
1061 | else
|
---|
1062 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "Request error: Failed to create temporary directory %s", szTmpDir);
|
---|
1063 |
|
---|
1064 | return rc;
|
---|
1065 | }
|
---|
1066 |
|
---|
1067 |
|
---|
1068 | /**
|
---|
1069 | * Creates a new fuzzing run with the given ID.
|
---|
1070 | *
|
---|
1071 | * @returns IPRT status code.
|
---|
1072 | * @param pThis The fuzzing master command state.
|
---|
1073 | * @param pszId The ID to use.
|
---|
1074 | * @param hJsonRoot The root node of the JSON request.
|
---|
1075 | * @param pErrInfo Where to store the error information on failure, optional.
|
---|
1076 | */
|
---|
1077 | static int rtFuzzCmdMasterCreateFuzzRunWithId(PRTFUZZCMDMASTER pThis, const char *pszId, RTJSONVAL hJsonRoot, PRTERRINFO pErrInfo)
|
---|
1078 | {
|
---|
1079 | int rc = VINF_SUCCESS;
|
---|
1080 | PRTFUZZRUN pFuzzRun = (PRTFUZZRUN)RTMemAllocZ(sizeof(*pFuzzRun));
|
---|
1081 | if (RT_LIKELY(pFuzzRun))
|
---|
1082 | {
|
---|
1083 | pFuzzRun->pszId = RTStrDup(pszId);
|
---|
1084 | if (RT_LIKELY(pFuzzRun->pszId))
|
---|
1085 | {
|
---|
1086 | rc = rtFuzzCmdMasterFuzzRunProcessTgtRecFlags(pFuzzRun, hJsonRoot, pErrInfo);
|
---|
1087 | if (RT_SUCCESS(rc))
|
---|
1088 | {
|
---|
1089 | rc = RTFuzzObsCreate(&pFuzzRun->hFuzzObs, RTFUZZCTXTYPE_BLOB, pFuzzRun->fTgtRecFlags);
|
---|
1090 | if (RT_SUCCESS(rc))
|
---|
1091 | {
|
---|
1092 | rc = rtFuzzCmdMasterFuzzRunProcessBinaryCfg(pFuzzRun, hJsonRoot, pErrInfo);
|
---|
1093 | if (RT_SUCCESS(rc))
|
---|
1094 | rc = rtFuzzCmdMasterFuzzRunProcessArgCfg(pFuzzRun, hJsonRoot, pErrInfo);
|
---|
1095 | if (RT_SUCCESS(rc))
|
---|
1096 | rc = rtFuzzCmdMasterFuzzRunProcessEnvironment(pFuzzRun, hJsonRoot, pErrInfo);
|
---|
1097 | if (RT_SUCCESS(rc))
|
---|
1098 | rc = rtFuzzCmdMasterFuzzRunProcessInputSeeds(pFuzzRun, hJsonRoot, pErrInfo);
|
---|
1099 | if (RT_SUCCESS(rc))
|
---|
1100 | rc = rtFuzzCmdMasterFuzzRunProcessMiscCfg(pFuzzRun, hJsonRoot, pErrInfo);
|
---|
1101 | if (RT_SUCCESS(rc))
|
---|
1102 | rc = rtFuzzCmdMasterFuzzRunProcessSanitizers(pFuzzRun, hJsonRoot, pErrInfo);
|
---|
1103 | if (RT_SUCCESS(rc))
|
---|
1104 | rc = rtFuzzCmdMasterFuzzRunSetupDirectories(pThis, pFuzzRun, pErrInfo);
|
---|
1105 |
|
---|
1106 | if (RT_SUCCESS(rc))
|
---|
1107 | {
|
---|
1108 | /* Start fuzzing. */
|
---|
1109 | RTListAppend(&pThis->LstFuzzed, &pFuzzRun->NdFuzzed);
|
---|
1110 | rc = RTFuzzObsExecStart(pFuzzRun->hFuzzObs, pFuzzRun->cProcs);
|
---|
1111 | if (RT_SUCCESS(rc))
|
---|
1112 | {
|
---|
1113 | RTTIMESPEC TimeSpec;
|
---|
1114 | RTTimeNow(&TimeSpec);
|
---|
1115 | RTTimeLocalExplode(&pFuzzRun->TimeCreated, &TimeSpec);
|
---|
1116 | pFuzzRun->tsCreatedMs = RTTimeMilliTS();
|
---|
1117 | pFuzzRun->fStarted = true;
|
---|
1118 | return VINF_SUCCESS;
|
---|
1119 | }
|
---|
1120 | else
|
---|
1121 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "Request error: Failed to start fuzzing with %Rrc", rc);
|
---|
1122 | }
|
---|
1123 |
|
---|
1124 | int rc2 = RTFuzzObsDestroy(pFuzzRun->hFuzzObs);
|
---|
1125 | AssertRC(rc2); RT_NOREF(rc2);
|
---|
1126 | }
|
---|
1127 | }
|
---|
1128 |
|
---|
1129 | RTStrFree(pFuzzRun->pszId);
|
---|
1130 | pFuzzRun->pszId = NULL;
|
---|
1131 | }
|
---|
1132 | else
|
---|
1133 | rc = VERR_NO_STR_MEMORY;
|
---|
1134 |
|
---|
1135 | RTMemFree(pFuzzRun);
|
---|
1136 | }
|
---|
1137 | else
|
---|
1138 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_NO_MEMORY, "Request error: Out of memory allocating the fuzzer state");
|
---|
1139 |
|
---|
1140 | return rc;
|
---|
1141 | }
|
---|
1142 |
|
---|
1143 |
|
---|
1144 | /**
|
---|
1145 | * Resolves the fuzzing run from the given ID config item and the given JSON request.
|
---|
1146 | *
|
---|
1147 | * @returns IPRT status code.
|
---|
1148 | * @param pThis The fuzzing master command state.
|
---|
1149 | * @param hJsonRoot The root node of the JSON request.
|
---|
1150 | * @param pszIdItem The JSON item which contains the ID of the fuzzing run.
|
---|
1151 | * @param ppFuzzRun Where to store the pointer to the fuzzing run on success.
|
---|
1152 | */
|
---|
1153 | static int rtFuzzCmdMasterQueryFuzzRunFromJson(PRTFUZZCMDMASTER pThis, RTJSONVAL hJsonRoot, const char *pszIdItem, PRTERRINFO pErrInfo,
|
---|
1154 | PRTFUZZRUN *ppFuzzRun)
|
---|
1155 | {
|
---|
1156 | RTJSONVAL hJsonValId;
|
---|
1157 | int rc = RTJsonValueQueryByName(hJsonRoot, pszIdItem, &hJsonValId);
|
---|
1158 | if (RT_SUCCESS(rc))
|
---|
1159 | {
|
---|
1160 | const char *pszId = RTJsonValueGetString(hJsonValId);
|
---|
1161 | if (pszId)
|
---|
1162 | {
|
---|
1163 | PRTFUZZRUN pFuzzRun = rtFuzzCmdMasterGetFuzzerById(pThis, pszId);
|
---|
1164 | if (pFuzzRun)
|
---|
1165 | *ppFuzzRun = pFuzzRun;
|
---|
1166 | else
|
---|
1167 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_NOT_FOUND, "Request error: The ID \"%s\" wasn't found", pszId);
|
---|
1168 | }
|
---|
1169 | else
|
---|
1170 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_JSON_VALUE_INVALID_TYPE, "JSON request malformed: \"Id\" is not a string value");
|
---|
1171 |
|
---|
1172 | RTJsonValueRelease(hJsonValId);
|
---|
1173 | }
|
---|
1174 | else
|
---|
1175 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: Couldn't find \"Id\" value");
|
---|
1176 | return rc;
|
---|
1177 | }
|
---|
1178 |
|
---|
1179 |
|
---|
1180 | /**
|
---|
1181 | * Processes the "StartFuzzing" request.
|
---|
1182 | *
|
---|
1183 | * @returns IPRT status code.
|
---|
1184 | * @param pThis The fuzzing master command state.
|
---|
1185 | * @param hJsonRoot The root node of the JSON request.
|
---|
1186 | * @param pErrInfo Where to store the error information on failure, optional.
|
---|
1187 | */
|
---|
1188 | static int rtFuzzCmdMasterProcessJsonReqStart(PRTFUZZCMDMASTER pThis, RTJSONVAL hJsonRoot, PRTERRINFO pErrInfo)
|
---|
1189 | {
|
---|
1190 | RTJSONVAL hJsonValId;
|
---|
1191 | int rc = RTJsonValueQueryByName(hJsonRoot, "Id", &hJsonValId);
|
---|
1192 | if (RT_SUCCESS(rc))
|
---|
1193 | {
|
---|
1194 | const char *pszId = RTJsonValueGetString(hJsonValId);
|
---|
1195 | if (pszId)
|
---|
1196 | {
|
---|
1197 | PRTFUZZRUN pFuzzRun = rtFuzzCmdMasterGetFuzzerById(pThis, pszId);
|
---|
1198 | if (!pFuzzRun)
|
---|
1199 | rc = rtFuzzCmdMasterCreateFuzzRunWithId(pThis, pszId, hJsonRoot, pErrInfo);
|
---|
1200 | else
|
---|
1201 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_ALREADY_EXISTS, "Request error: The ID \"%s\" is already registered", pszId);
|
---|
1202 | }
|
---|
1203 | else
|
---|
1204 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_JSON_VALUE_INVALID_TYPE, "JSON request malformed: \"Id\" is not a string value");
|
---|
1205 |
|
---|
1206 | RTJsonValueRelease(hJsonValId);
|
---|
1207 | }
|
---|
1208 | else
|
---|
1209 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: Couldn't find \"Id\" value");
|
---|
1210 | return rc;
|
---|
1211 | }
|
---|
1212 |
|
---|
1213 |
|
---|
1214 | /**
|
---|
1215 | * Processes the "StopFuzzing" request.
|
---|
1216 | *
|
---|
1217 | * @returns IPRT status code.
|
---|
1218 | * @param pThis The fuzzing master command state.
|
---|
1219 | * @param hJsonValRoot The root node of the JSON request.
|
---|
1220 | * @param pErrInfo Where to store the error information on failure, optional.
|
---|
1221 | */
|
---|
1222 | static int rtFuzzCmdMasterProcessJsonReqStop(PRTFUZZCMDMASTER pThis, RTJSONVAL hJsonRoot, PRTERRINFO pErrInfo)
|
---|
1223 | {
|
---|
1224 | PRTFUZZRUN pFuzzRun;
|
---|
1225 | int rc = rtFuzzCmdMasterQueryFuzzRunFromJson(pThis, hJsonRoot, "Id", pErrInfo, &pFuzzRun);
|
---|
1226 | if (RT_SUCCESS(rc))
|
---|
1227 | {
|
---|
1228 | RTListNodeRemove(&pFuzzRun->NdFuzzed);
|
---|
1229 | RTFuzzObsExecStop(pFuzzRun->hFuzzObs);
|
---|
1230 | RTFuzzObsDestroy(pFuzzRun->hFuzzObs);
|
---|
1231 | RTStrFree(pFuzzRun->pszId);
|
---|
1232 | RTMemFree(pFuzzRun);
|
---|
1233 | }
|
---|
1234 |
|
---|
1235 | return rc;
|
---|
1236 | }
|
---|
1237 |
|
---|
1238 |
|
---|
1239 | /**
|
---|
1240 | * Processes the "SuspendFuzzing" request.
|
---|
1241 | *
|
---|
1242 | * @returns IPRT status code.
|
---|
1243 | * @param pThis The fuzzing master command state.
|
---|
1244 | * @param hJsonValRoot The root node of the JSON request.
|
---|
1245 | * @param pErrInfo Where to store the error information on failure, optional.
|
---|
1246 | */
|
---|
1247 | static int rtFuzzCmdMasterProcessJsonReqSuspend(PRTFUZZCMDMASTER pThis, RTJSONVAL hJsonRoot, PRTERRINFO pErrInfo)
|
---|
1248 | {
|
---|
1249 | PRTFUZZRUN pFuzzRun;
|
---|
1250 | int rc = rtFuzzCmdMasterQueryFuzzRunFromJson(pThis, hJsonRoot, "Id", pErrInfo, &pFuzzRun);
|
---|
1251 | if (RT_SUCCESS(rc))
|
---|
1252 | {
|
---|
1253 | if (pFuzzRun->fStarted)
|
---|
1254 | {
|
---|
1255 | rc = RTFuzzObsExecStop(pFuzzRun->hFuzzObs);
|
---|
1256 | if (RT_SUCCESS(rc))
|
---|
1257 | pFuzzRun->fStarted = false;
|
---|
1258 | else
|
---|
1259 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "Request error: Suspending the fuzzing process failed");
|
---|
1260 | }
|
---|
1261 | }
|
---|
1262 |
|
---|
1263 | return rc;
|
---|
1264 | }
|
---|
1265 |
|
---|
1266 |
|
---|
1267 | /**
|
---|
1268 | * Processes the "ResumeFuzzing" request.
|
---|
1269 | *
|
---|
1270 | * @returns IPRT status code.
|
---|
1271 | * @param pThis The fuzzing master command state.
|
---|
1272 | * @param hJsonValRoot The root node of the JSON request.
|
---|
1273 | * @param pErrInfo Where to store the error information on failure, optional.
|
---|
1274 | */
|
---|
1275 | static int rtFuzzCmdMasterProcessJsonReqResume(PRTFUZZCMDMASTER pThis, RTJSONVAL hJsonRoot, PRTERRINFO pErrInfo)
|
---|
1276 | {
|
---|
1277 | PRTFUZZRUN pFuzzRun;
|
---|
1278 | int rc = rtFuzzCmdMasterQueryFuzzRunFromJson(pThis, hJsonRoot, "Id", pErrInfo, &pFuzzRun);
|
---|
1279 | if (RT_SUCCESS(rc))
|
---|
1280 | {
|
---|
1281 | if (!pFuzzRun->fStarted)
|
---|
1282 | {
|
---|
1283 | rc = rtFuzzCmdMasterFuzzRunProcessCfgU32Def(&pFuzzRun->cProcs, "FuzzingProcs", hJsonRoot, pFuzzRun->cProcs, pErrInfo);
|
---|
1284 | if (RT_SUCCESS(rc))
|
---|
1285 | {
|
---|
1286 | rc = RTFuzzObsExecStart(pFuzzRun->hFuzzObs, pFuzzRun->cProcs);
|
---|
1287 | if (RT_SUCCESS(rc))
|
---|
1288 | pFuzzRun->fStarted = true;
|
---|
1289 | else
|
---|
1290 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "Request error: Resuming the fuzzing process failed");
|
---|
1291 | }
|
---|
1292 | }
|
---|
1293 | }
|
---|
1294 |
|
---|
1295 | return rc;
|
---|
1296 | }
|
---|
1297 |
|
---|
1298 |
|
---|
1299 | /**
|
---|
1300 | * Processes the "SaveFuzzingState" request.
|
---|
1301 | *
|
---|
1302 | * @returns IPRT status code.
|
---|
1303 | * @param pThis The fuzzing master command state.
|
---|
1304 | * @param hJsonValRoot The root node of the JSON request.
|
---|
1305 | * @param pErrInfo Where to store the error information on failure, optional.
|
---|
1306 | */
|
---|
1307 | static int rtFuzzCmdMasterProcessJsonReqSaveState(PRTFUZZCMDMASTER pThis, RTJSONVAL hJsonRoot, PRTERRINFO pErrInfo)
|
---|
1308 | {
|
---|
1309 | PRTFUZZRUN pFuzzRun;
|
---|
1310 | int rc = rtFuzzCmdMasterQueryFuzzRunFromJson(pThis, hJsonRoot, "Id", pErrInfo, &pFuzzRun);
|
---|
1311 | if (RT_SUCCESS(rc))
|
---|
1312 | {
|
---|
1313 | /* Suspend fuzzing, save and resume if not stopped. */
|
---|
1314 | if (pFuzzRun->fStarted)
|
---|
1315 | {
|
---|
1316 | rc = RTFuzzObsExecStop(pFuzzRun->hFuzzObs);
|
---|
1317 | if (RT_FAILURE(rc))
|
---|
1318 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "Request error: Suspending the fuzzing process failed");
|
---|
1319 | }
|
---|
1320 |
|
---|
1321 | if (RT_SUCCESS(rc))
|
---|
1322 | {
|
---|
1323 | RTFUZZCTX hFuzzCtx;
|
---|
1324 | rc = RTFuzzObsQueryCtx(pFuzzRun->hFuzzObs, &hFuzzCtx);
|
---|
1325 | AssertRC(rc);
|
---|
1326 |
|
---|
1327 | void *pvState = NULL;
|
---|
1328 | size_t cbState = 0;
|
---|
1329 | rc = RTFuzzCtxStateExportToMem(hFuzzCtx, &pvState, &cbState);
|
---|
1330 | if (RT_SUCCESS(rc))
|
---|
1331 | {
|
---|
1332 | /* Encode to base64. */
|
---|
1333 | size_t cbStateStr = RTBase64EncodedLength(cbState) + 1;
|
---|
1334 | char *pszState = (char *)RTMemAllocZ(cbStateStr);
|
---|
1335 | if (pszState)
|
---|
1336 | {
|
---|
1337 | rc = RTBase64Encode(pvState, cbState, pszState, cbStateStr, &cbStateStr);
|
---|
1338 | if (RT_SUCCESS(rc))
|
---|
1339 | {
|
---|
1340 | /* Strip all new lines from the srting. */
|
---|
1341 | size_t offStr = 0;
|
---|
1342 | while (offStr < cbStateStr)
|
---|
1343 | {
|
---|
1344 | #if defined(RT_OS_WINDOWS) || defined(RT_OS_OS2)
|
---|
1345 | char *pszEol = strchr(&pszState[offStr], '\r');
|
---|
1346 | #else
|
---|
1347 | char *pszEol = strchr(&pszState[offStr], '\n');
|
---|
1348 | #endif
|
---|
1349 | if (pszEol)
|
---|
1350 | {
|
---|
1351 | offStr += pszEol - &pszState[offStr];
|
---|
1352 | memmove(pszEol, &pszEol[RTBASE64_EOL_SIZE], cbStateStr - offStr - RTBASE64_EOL_SIZE);
|
---|
1353 | cbStateStr -= RTBASE64_EOL_SIZE;
|
---|
1354 | }
|
---|
1355 | else
|
---|
1356 | break;
|
---|
1357 | }
|
---|
1358 |
|
---|
1359 | const char s_szState[] = "{ \"State\": %s }";
|
---|
1360 | pThis->pszResponse = RTStrAPrintf2(s_szState, pszState);
|
---|
1361 | if (RT_UNLIKELY(!pThis->pszResponse))
|
---|
1362 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_BUFFER_OVERFLOW, "Request error: Response data buffer overflow", rc);
|
---|
1363 | }
|
---|
1364 | else
|
---|
1365 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "Request error: Failed to encode the state as a base64 string");
|
---|
1366 | RTMemFree(pszState);
|
---|
1367 | }
|
---|
1368 | else
|
---|
1369 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_NO_STR_MEMORY, "Request error: Failed to allocate a state string for the response");
|
---|
1370 | RTMemFree(pvState);
|
---|
1371 | }
|
---|
1372 | else
|
---|
1373 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "Request error: Exporting the state failed");
|
---|
1374 | }
|
---|
1375 |
|
---|
1376 | if (pFuzzRun->fStarted)
|
---|
1377 | {
|
---|
1378 | int rc2 = RTFuzzObsExecStart(pFuzzRun->hFuzzObs, pFuzzRun->cProcs);
|
---|
1379 | if (RT_FAILURE(rc2))
|
---|
1380 | rtFuzzCmdMasterErrorRc(pErrInfo, rc2, "Request error: Resuming the fuzzing process failed");
|
---|
1381 | }
|
---|
1382 | }
|
---|
1383 |
|
---|
1384 | return rc;
|
---|
1385 | }
|
---|
1386 |
|
---|
1387 |
|
---|
1388 | /**
|
---|
1389 | * Queries the statistics for the given fuzzing run and adds the result to the response.
|
---|
1390 | *
|
---|
1391 | * @returns IPRT static code.
|
---|
1392 | * @param pThis The fuzzing master command state.
|
---|
1393 | * @param pFuzzRun The fuzzing run.
|
---|
1394 | * @param pszIndent Indentation to use.
|
---|
1395 | * @param fLast Flags whether this is the last element in the list.
|
---|
1396 | * @param pErrInfo Where to store the error information on failure, optional.
|
---|
1397 | */
|
---|
1398 | static int rtFuzzCmdMasterProcessQueryRunStats(PRTFUZZCMDMASTER pThis, PRTFUZZRUN pFuzzRun,
|
---|
1399 | const char *pszIndent, bool fLast, PRTERRINFO pErrInfo)
|
---|
1400 | {
|
---|
1401 | RTFUZZOBSSTATS ObsStats;
|
---|
1402 | RTFUZZCTXSTATS CtxStats;
|
---|
1403 | RTFUZZCTX hFuzzCtx;
|
---|
1404 | RT_ZERO(ObsStats); RT_ZERO(CtxStats);
|
---|
1405 |
|
---|
1406 | int rc = RTFuzzObsQueryCtx(pFuzzRun->hFuzzObs, &hFuzzCtx);
|
---|
1407 | if (RT_SUCCESS(rc))
|
---|
1408 | {
|
---|
1409 | rc = RTFuzzCtxQueryStats(hFuzzCtx, &CtxStats);
|
---|
1410 | RTFuzzCtxRelease(hFuzzCtx);
|
---|
1411 | }
|
---|
1412 |
|
---|
1413 | if (RT_SUCCESS(rc))
|
---|
1414 | rc = RTFuzzObsQueryStats(pFuzzRun->hFuzzObs, &ObsStats);
|
---|
1415 | if (RT_SUCCESS(rc))
|
---|
1416 | {
|
---|
1417 | const char s_szStatsFmt[] = "%s{ \n"
|
---|
1418 | "%s \"Id\": \"%s\"\n"
|
---|
1419 | "%s \"TimeCreated\": \"%s\"\n"
|
---|
1420 | "%s \"UptimeSec\": %llu\n"
|
---|
1421 | "%s \"FuzzedInputsPerSec\": %u\n"
|
---|
1422 | "%s \"FuzzedInputs\": %u\n"
|
---|
1423 | "%s \"FuzzedInputsHang\": %u\n"
|
---|
1424 | "%s \"FuzzedInputsCrash\": %u\n"
|
---|
1425 | "%s \"MemoryUsage\": %zu\n"
|
---|
1426 | "%s \"CorpusSize\": %llu\n"
|
---|
1427 | "%s}%s\n";
|
---|
1428 | char aszTime[_1K]; RT_ZERO(aszTime);
|
---|
1429 | char aszStats[_4K]; RT_ZERO(aszStats);
|
---|
1430 |
|
---|
1431 | if (RTTimeToString(&pFuzzRun->TimeCreated, aszTime, sizeof(aszTime)))
|
---|
1432 | {
|
---|
1433 | ssize_t cchStats = RTStrPrintf2(&aszStats[0], sizeof(aszStats),
|
---|
1434 | s_szStatsFmt, pszIndent,
|
---|
1435 | pszIndent, pFuzzRun->pszId,
|
---|
1436 | pszIndent, aszTime,
|
---|
1437 | pszIndent, (RTTimeMilliTS() - pFuzzRun->tsCreatedMs) / RT_MS_1SEC_64,
|
---|
1438 | pszIndent, ObsStats.cFuzzedInputsPerSec,
|
---|
1439 | pszIndent, ObsStats.cFuzzedInputs,
|
---|
1440 | pszIndent, ObsStats.cFuzzedInputsHang,
|
---|
1441 | pszIndent, ObsStats.cFuzzedInputsCrash,
|
---|
1442 | pszIndent, CtxStats.cbMemory,
|
---|
1443 | pszIndent, CtxStats.cMutations,
|
---|
1444 | pszIndent, fLast ? "" : ",");
|
---|
1445 | if (RT_LIKELY(cchStats > 0))
|
---|
1446 | {
|
---|
1447 | rc = RTStrAAppend(&pThis->pszResponse, &aszStats[0]);
|
---|
1448 | if (RT_FAILURE(rc))
|
---|
1449 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "Request error: Failed to build statistics response", rc);
|
---|
1450 | }
|
---|
1451 | else
|
---|
1452 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_BUFFER_OVERFLOW, "Request error: Response data buffer overflow");
|
---|
1453 | }
|
---|
1454 | else
|
---|
1455 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_BUFFER_OVERFLOW, "Request error: Buffer overflow conerting time to string");
|
---|
1456 | }
|
---|
1457 | else
|
---|
1458 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "Request error: Failed to query fuzzing statistics with %Rrc", rc);
|
---|
1459 |
|
---|
1460 | return rc;
|
---|
1461 | }
|
---|
1462 |
|
---|
1463 |
|
---|
1464 | /**
|
---|
1465 | * Processes the "QueryStats" request.
|
---|
1466 | *
|
---|
1467 | * @returns IPRT status code.
|
---|
1468 | * @param pThis The fuzzing master command state.
|
---|
1469 | * @param hJsonValRoot The root node of the JSON request.
|
---|
1470 | * @param pErrInfo Where to store the error information on failure, optional.
|
---|
1471 | */
|
---|
1472 | static int rtFuzzCmdMasterProcessJsonReqQueryStats(PRTFUZZCMDMASTER pThis, RTJSONVAL hJsonRoot, PRTERRINFO pErrInfo)
|
---|
1473 | {
|
---|
1474 | RTJSONVAL hJsonValId;
|
---|
1475 | int rc = RTJsonValueQueryByName(hJsonRoot, "Id", &hJsonValId);
|
---|
1476 | if (RT_SUCCESS(rc))
|
---|
1477 | {
|
---|
1478 | RTJsonValueRelease(hJsonValId);
|
---|
1479 | PRTFUZZRUN pFuzzRun;
|
---|
1480 | rc = rtFuzzCmdMasterQueryFuzzRunFromJson(pThis, hJsonRoot, "Id", pErrInfo, &pFuzzRun);
|
---|
1481 | if (RT_SUCCESS(rc))
|
---|
1482 | rc = rtFuzzCmdMasterProcessQueryRunStats(pThis, pFuzzRun, " ",
|
---|
1483 | true /*fLast*/, pErrInfo);
|
---|
1484 | }
|
---|
1485 | else if (rc == VERR_NOT_FOUND)
|
---|
1486 | {
|
---|
1487 | /* Id is not there, so collect statistics of all running jobs. */
|
---|
1488 | rc = RTStrAAppend(&pThis->pszResponse, " [\n");
|
---|
1489 | if (RT_SUCCESS(rc))
|
---|
1490 | {
|
---|
1491 | PRTFUZZRUN pRun = NULL;
|
---|
1492 | RTListForEach(&pThis->LstFuzzed, pRun, RTFUZZRUN, NdFuzzed)
|
---|
1493 | {
|
---|
1494 | bool fLast = RTListNodeIsLast(&pThis->LstFuzzed, &pRun->NdFuzzed);
|
---|
1495 | rc = rtFuzzCmdMasterProcessQueryRunStats(pThis, pRun, " ", fLast, pErrInfo);
|
---|
1496 | if (RT_FAILURE(rc))
|
---|
1497 | break;
|
---|
1498 | }
|
---|
1499 | if (RT_SUCCESS(rc))
|
---|
1500 | rc = RTStrAAppend(&pThis->pszResponse, " ]\n");
|
---|
1501 | }
|
---|
1502 | }
|
---|
1503 | else
|
---|
1504 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: Couldn't get \"Id\" value");
|
---|
1505 |
|
---|
1506 | return rc;
|
---|
1507 | }
|
---|
1508 |
|
---|
1509 |
|
---|
1510 | /**
|
---|
1511 | * Processes a JSON request.
|
---|
1512 | *
|
---|
1513 | * @returns IPRT status code.
|
---|
1514 | * @param pThis The fuzzing master command state.
|
---|
1515 | * @param hJsonValRoot The root node of the JSON request.
|
---|
1516 | * @param pErrInfo Where to store the error information on failure, optional.
|
---|
1517 | */
|
---|
1518 | static int rtFuzzCmdMasterProcessJsonReq(PRTFUZZCMDMASTER pThis, RTJSONVAL hJsonRoot, PRTERRINFO pErrInfo)
|
---|
1519 | {
|
---|
1520 | RTJSONVAL hJsonValReq;
|
---|
1521 | int rc = RTJsonValueQueryByName(hJsonRoot, "Request", &hJsonValReq);
|
---|
1522 | if (RT_SUCCESS(rc))
|
---|
1523 | {
|
---|
1524 | const char *pszReq = RTJsonValueGetString(hJsonValReq);
|
---|
1525 | if (pszReq)
|
---|
1526 | {
|
---|
1527 | if (!RTStrCmp(pszReq, "StartFuzzing"))
|
---|
1528 | rc = rtFuzzCmdMasterProcessJsonReqStart(pThis, hJsonRoot, pErrInfo);
|
---|
1529 | else if (!RTStrCmp(pszReq, "StopFuzzing"))
|
---|
1530 | rc = rtFuzzCmdMasterProcessJsonReqStop(pThis, hJsonRoot, pErrInfo);
|
---|
1531 | else if (!RTStrCmp(pszReq, "SuspendFuzzing"))
|
---|
1532 | rc = rtFuzzCmdMasterProcessJsonReqSuspend(pThis, hJsonRoot, pErrInfo);
|
---|
1533 | else if (!RTStrCmp(pszReq, "ResumeFuzzing"))
|
---|
1534 | rc = rtFuzzCmdMasterProcessJsonReqResume(pThis, hJsonRoot, pErrInfo);
|
---|
1535 | else if (!RTStrCmp(pszReq, "SaveFuzzingState"))
|
---|
1536 | rc = rtFuzzCmdMasterProcessJsonReqSaveState(pThis, hJsonRoot, pErrInfo);
|
---|
1537 | else if (!RTStrCmp(pszReq, "QueryStats"))
|
---|
1538 | rc = rtFuzzCmdMasterProcessJsonReqQueryStats(pThis, hJsonRoot, pErrInfo);
|
---|
1539 | else if (!RTStrCmp(pszReq, "Shutdown"))
|
---|
1540 | pThis->fShutdown = true;
|
---|
1541 | else
|
---|
1542 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_JSON_VALUE_INVALID_TYPE, "JSON request malformed: \"Request\" contains unknown value \"%s\"", pszReq);
|
---|
1543 | }
|
---|
1544 | else
|
---|
1545 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, VERR_JSON_VALUE_INVALID_TYPE, "JSON request malformed: \"Request\" is not a string value");
|
---|
1546 |
|
---|
1547 | RTJsonValueRelease(hJsonValReq);
|
---|
1548 | }
|
---|
1549 | else
|
---|
1550 | rc = rtFuzzCmdMasterErrorRc(pErrInfo, rc, "JSON request malformed: Couldn't find \"Request\" value");
|
---|
1551 |
|
---|
1552 | return rc;
|
---|
1553 | }
|
---|
1554 |
|
---|
1555 |
|
---|
1556 | /**
|
---|
1557 | * Loads a fuzzing configuration for immediate startup from the given file.
|
---|
1558 | *
|
---|
1559 | * @returns IPRT status code.
|
---|
1560 | * @param pThis The fuzzing master command state.
|
---|
1561 | * @param pszFuzzCfg The fuzzing config to load.
|
---|
1562 | */
|
---|
1563 | static int rtFuzzCmdMasterFuzzCfgLoadFromFile(PRTFUZZCMDMASTER pThis, const char *pszFuzzCfg)
|
---|
1564 | {
|
---|
1565 | RTJSONVAL hJsonRoot;
|
---|
1566 | int rc = RTJsonParseFromFile(&hJsonRoot, pszFuzzCfg, NULL);
|
---|
1567 | if (RT_SUCCESS(rc))
|
---|
1568 | {
|
---|
1569 | rc = rtFuzzCmdMasterProcessJsonReqStart(pThis, hJsonRoot, NULL);
|
---|
1570 | RTJsonValueRelease(hJsonRoot);
|
---|
1571 | }
|
---|
1572 | else
|
---|
1573 | rc = rtFuzzCmdMasterErrorRc(NULL, rc, "JSON request malformed: Couldn't load file \"%s\"", pszFuzzCfg);
|
---|
1574 |
|
---|
1575 | return rc;
|
---|
1576 | }
|
---|
1577 |
|
---|
1578 |
|
---|
1579 | /**
|
---|
1580 | * Destroys all running fuzzers for the given master state.
|
---|
1581 | *
|
---|
1582 | * @returns nothing.
|
---|
1583 | * @param pThis The fuzzing master command state.
|
---|
1584 | */
|
---|
1585 | static void rtFuzzCmdMasterDestroy(PRTFUZZCMDMASTER pThis)
|
---|
1586 | {
|
---|
1587 | RT_NOREF(pThis);
|
---|
1588 | }
|
---|
1589 |
|
---|
1590 |
|
---|
1591 | /**
|
---|
1592 | * Sends an ACK response to the client.
|
---|
1593 | *
|
---|
1594 | * @returns nothing.
|
---|
1595 | * @param hSocket The socket handle to send the ACK to.
|
---|
1596 | * @param pszResponse Additional response data.
|
---|
1597 | */
|
---|
1598 | static void rtFuzzCmdMasterTcpSendAck(RTSOCKET hSocket, const char *pszResponse)
|
---|
1599 | {
|
---|
1600 | const char s_szSucc[] = "{ \"Status\": \"ACK\" }\n";
|
---|
1601 | const char s_szSuccResp[] = "{ \"Status\": \"ACK\"\n \"Response\":\n";
|
---|
1602 | const char s_szSuccRespClose[] = "\n }\n";
|
---|
1603 | if (pszResponse)
|
---|
1604 | {
|
---|
1605 | RTSGSEG aSegs[3];
|
---|
1606 | RTSGBUF SgBuf;
|
---|
1607 | aSegs[0].pvSeg = (void *)s_szSuccResp;
|
---|
1608 | aSegs[0].cbSeg = sizeof(s_szSuccResp) - 1;
|
---|
1609 | aSegs[1].pvSeg = (void *)pszResponse;
|
---|
1610 | aSegs[1].cbSeg = strlen(pszResponse);
|
---|
1611 | aSegs[2].pvSeg = (void *)s_szSuccRespClose;
|
---|
1612 | aSegs[2].cbSeg = sizeof(s_szSuccRespClose) - 1;
|
---|
1613 |
|
---|
1614 | RTSgBufInit(&SgBuf, &aSegs[0], RT_ELEMENTS(aSegs));
|
---|
1615 | RTTcpSgWrite(hSocket, &SgBuf);
|
---|
1616 | }
|
---|
1617 | else
|
---|
1618 | RTTcpWrite(hSocket, s_szSucc, sizeof(s_szSucc));
|
---|
1619 | }
|
---|
1620 |
|
---|
1621 |
|
---|
1622 | /**
|
---|
1623 | * Sends an NACK response to the client.
|
---|
1624 | *
|
---|
1625 | * @returns nothing.
|
---|
1626 | * @param hSocket The socket handle to send the ACK to.
|
---|
1627 | * @param pErrInfo Optional error information to send along.
|
---|
1628 | */
|
---|
1629 | static void rtFuzzCmdMasterTcpSendNAck(RTSOCKET hSocket, PRTERRINFO pErrInfo)
|
---|
1630 | {
|
---|
1631 | const char s_szFail[] = "{ \"Status\": \"NACK\" }\n";
|
---|
1632 | const char s_szFailInfo[] = "{ \"Status\": \"NACK\"\n \"Information\": \"%s\" }\n";
|
---|
1633 |
|
---|
1634 | if (pErrInfo)
|
---|
1635 | {
|
---|
1636 | char szTmp[_1K];
|
---|
1637 | ssize_t cchResp = RTStrPrintf2(szTmp, sizeof(szTmp), s_szFailInfo, pErrInfo->pszMsg);
|
---|
1638 | if (cchResp > 0)
|
---|
1639 | RTTcpWrite(hSocket, szTmp, cchResp);
|
---|
1640 | else
|
---|
1641 | RTTcpWrite(hSocket, s_szFail, strlen(s_szFail));
|
---|
1642 | }
|
---|
1643 | else
|
---|
1644 | RTTcpWrite(hSocket, s_szFail, strlen(s_szFail));
|
---|
1645 | }
|
---|
1646 |
|
---|
1647 |
|
---|
1648 | /**
|
---|
1649 | * TCP server serving callback for a single connection.
|
---|
1650 | *
|
---|
1651 | * @returns IPRT status code.
|
---|
1652 | * @param hSocket The socket handle of the connection.
|
---|
1653 | * @param pvUser Opaque user data.
|
---|
1654 | */
|
---|
1655 | static DECLCALLBACK(int) rtFuzzCmdMasterTcpServe(RTSOCKET hSocket, void *pvUser)
|
---|
1656 | {
|
---|
1657 | PRTFUZZCMDMASTER pThis = (PRTFUZZCMDMASTER)pvUser;
|
---|
1658 | size_t cbReqMax = _32K;
|
---|
1659 | size_t cbReq = 0;
|
---|
1660 | uint8_t *pbReq = (uint8_t *)RTMemAllocZ(cbReqMax);
|
---|
1661 |
|
---|
1662 | if (RT_LIKELY(pbReq))
|
---|
1663 | {
|
---|
1664 | uint8_t *pbCur = pbReq;
|
---|
1665 |
|
---|
1666 | for (;;)
|
---|
1667 | {
|
---|
1668 | size_t cbThisRead = cbReqMax - cbReq;
|
---|
1669 | int rc = RTTcpRead(hSocket, pbCur, cbThisRead, &cbThisRead);
|
---|
1670 | if ( RT_SUCCESS(rc)
|
---|
1671 | && cbThisRead)
|
---|
1672 | {
|
---|
1673 | cbReq += cbThisRead;
|
---|
1674 |
|
---|
1675 | /* Check for a zero terminator marking the end of the request. */
|
---|
1676 | uint8_t *pbEnd = (uint8_t *)memchr(pbCur, 0, cbThisRead);
|
---|
1677 | if (pbEnd)
|
---|
1678 | {
|
---|
1679 | /* Adjust request size, data coming after the zero terminiator is ignored right now. */
|
---|
1680 | cbReq -= cbThisRead - (pbEnd - pbCur) + 1;
|
---|
1681 |
|
---|
1682 | RTJSONVAL hJsonReq;
|
---|
1683 | RTERRINFOSTATIC ErrInfo;
|
---|
1684 | RTErrInfoInitStatic(&ErrInfo);
|
---|
1685 |
|
---|
1686 | rc = RTJsonParseFromBuf(&hJsonReq, pbReq, cbReq, &ErrInfo.Core);
|
---|
1687 | if (RT_SUCCESS(rc))
|
---|
1688 | {
|
---|
1689 | rc = rtFuzzCmdMasterProcessJsonReq(pThis, hJsonReq, &ErrInfo.Core);
|
---|
1690 | if (RT_SUCCESS(rc))
|
---|
1691 | rtFuzzCmdMasterTcpSendAck(hSocket, pThis->pszResponse);
|
---|
1692 | else
|
---|
1693 | rtFuzzCmdMasterTcpSendNAck(hSocket, &ErrInfo.Core);
|
---|
1694 | RTJsonValueRelease(hJsonReq);
|
---|
1695 | }
|
---|
1696 | else
|
---|
1697 | rtFuzzCmdMasterTcpSendNAck(hSocket, &ErrInfo.Core);
|
---|
1698 |
|
---|
1699 | if (pThis->pszResponse)
|
---|
1700 | {
|
---|
1701 | RTStrFree(pThis->pszResponse);
|
---|
1702 | pThis->pszResponse = NULL;
|
---|
1703 | }
|
---|
1704 | break;
|
---|
1705 | }
|
---|
1706 | else if (cbReq == cbReqMax)
|
---|
1707 | {
|
---|
1708 | /* Try to increase the buffer. */
|
---|
1709 | uint8_t *pbReqNew = (uint8_t *)RTMemRealloc(pbReq, cbReqMax + _32K);
|
---|
1710 | if (RT_LIKELY(pbReqNew))
|
---|
1711 | {
|
---|
1712 | cbReqMax += _32K;
|
---|
1713 | pbReq = pbReqNew;
|
---|
1714 | pbCur = pbReq + cbReq;
|
---|
1715 | }
|
---|
1716 | else
|
---|
1717 | rtFuzzCmdMasterTcpSendNAck(hSocket, NULL);
|
---|
1718 | }
|
---|
1719 | else
|
---|
1720 | pbCur += cbThisRead;
|
---|
1721 | }
|
---|
1722 | else
|
---|
1723 | break;
|
---|
1724 | }
|
---|
1725 | }
|
---|
1726 | else
|
---|
1727 | rtFuzzCmdMasterTcpSendNAck(hSocket, NULL);
|
---|
1728 |
|
---|
1729 | if (pbReq)
|
---|
1730 | RTMemFree(pbReq);
|
---|
1731 |
|
---|
1732 | return pThis->fShutdown ? VERR_TCP_SERVER_STOP : VINF_SUCCESS;
|
---|
1733 | }
|
---|
1734 |
|
---|
1735 |
|
---|
1736 | /**
|
---|
1737 | * Mainloop for the fuzzing master.
|
---|
1738 | *
|
---|
1739 | * @returns Process exit code.
|
---|
1740 | * @param pThis The fuzzing master command state.
|
---|
1741 | * @param pszLoadCfg Initial config to load.
|
---|
1742 | */
|
---|
1743 | static RTEXITCODE rtFuzzCmdMasterRun(PRTFUZZCMDMASTER pThis, const char *pszLoadCfg)
|
---|
1744 | {
|
---|
1745 | if (pszLoadCfg)
|
---|
1746 | {
|
---|
1747 | int rc = rtFuzzCmdMasterFuzzCfgLoadFromFile(pThis, pszLoadCfg);
|
---|
1748 | if (RT_FAILURE(rc))
|
---|
1749 | return RTEXITCODE_FAILURE;
|
---|
1750 | }
|
---|
1751 |
|
---|
1752 | /* Start up the control server. */
|
---|
1753 | int rc = RTTcpServerCreateEx(NULL, pThis->uPort, &pThis->hTcpSrv);
|
---|
1754 | if (RT_SUCCESS(rc))
|
---|
1755 | {
|
---|
1756 | do
|
---|
1757 | {
|
---|
1758 | rc = RTTcpServerListen(pThis->hTcpSrv, rtFuzzCmdMasterTcpServe, pThis);
|
---|
1759 | } while (rc != VERR_TCP_SERVER_STOP);
|
---|
1760 | }
|
---|
1761 |
|
---|
1762 | RTTcpServerDestroy(pThis->hTcpSrv);
|
---|
1763 | rtFuzzCmdMasterDestroy(pThis);
|
---|
1764 | return RTEXITCODE_SUCCESS;
|
---|
1765 | }
|
---|
1766 |
|
---|
1767 |
|
---|
1768 | RTR3DECL(RTEXITCODE) RTFuzzCmdMaster(unsigned cArgs, char **papszArgs)
|
---|
1769 | {
|
---|
1770 | /*
|
---|
1771 | * Parse the command line.
|
---|
1772 | */
|
---|
1773 | static const RTGETOPTDEF s_aOptions[] =
|
---|
1774 | {
|
---|
1775 | { "--fuzz-config", 'c', RTGETOPT_REQ_STRING },
|
---|
1776 | { "--temp-dir", 't', RTGETOPT_REQ_STRING },
|
---|
1777 | { "--results-dir", 'r', RTGETOPT_REQ_STRING },
|
---|
1778 | { "--listen-port", 'p', RTGETOPT_REQ_UINT16 },
|
---|
1779 | { "--daemonize", 'd', RTGETOPT_REQ_NOTHING },
|
---|
1780 | { "--daemonized", 'Z', RTGETOPT_REQ_NOTHING },
|
---|
1781 | { "--help", 'h', RTGETOPT_REQ_NOTHING },
|
---|
1782 | { "--version", 'V', RTGETOPT_REQ_NOTHING },
|
---|
1783 | };
|
---|
1784 |
|
---|
1785 | RTEXITCODE rcExit = RTEXITCODE_SUCCESS;
|
---|
1786 | RTGETOPTSTATE GetState;
|
---|
1787 | int rc = RTGetOptInit(&GetState, cArgs, papszArgs, s_aOptions, RT_ELEMENTS(s_aOptions), 1,
|
---|
1788 | RTGETOPTINIT_FLAGS_OPTS_FIRST);
|
---|
1789 | if (RT_SUCCESS(rc))
|
---|
1790 | {
|
---|
1791 | /* Option variables: */
|
---|
1792 | bool fDaemonize = false;
|
---|
1793 | bool fDaemonized = false;
|
---|
1794 | const char *pszLoadCfg = NULL;
|
---|
1795 | RTFUZZCMDMASTER This;
|
---|
1796 |
|
---|
1797 | RTListInit(&This.LstFuzzed);
|
---|
1798 | This.hTcpSrv = NIL_RTTCPSERVER;
|
---|
1799 | This.uPort = 4242;
|
---|
1800 | This.pszTmpDir = NULL;
|
---|
1801 | This.pszResultsDir = NULL;
|
---|
1802 | This.fShutdown = false;
|
---|
1803 | This.pszResponse = NULL;
|
---|
1804 |
|
---|
1805 | /* Argument parsing loop. */
|
---|
1806 | bool fContinue = true;
|
---|
1807 | do
|
---|
1808 | {
|
---|
1809 | RTGETOPTUNION ValueUnion;
|
---|
1810 | int chOpt = RTGetOpt(&GetState, &ValueUnion);
|
---|
1811 | switch (chOpt)
|
---|
1812 | {
|
---|
1813 | case 0:
|
---|
1814 | fContinue = false;
|
---|
1815 | break;
|
---|
1816 |
|
---|
1817 | case 'c':
|
---|
1818 | pszLoadCfg = ValueUnion.psz;
|
---|
1819 | break;
|
---|
1820 |
|
---|
1821 | case 'p':
|
---|
1822 | This.uPort = ValueUnion.u16;
|
---|
1823 | break;
|
---|
1824 |
|
---|
1825 | case 't':
|
---|
1826 | This.pszTmpDir = ValueUnion.psz;
|
---|
1827 | break;
|
---|
1828 |
|
---|
1829 | case 'r':
|
---|
1830 | This.pszResultsDir = ValueUnion.psz;
|
---|
1831 | break;
|
---|
1832 |
|
---|
1833 | case 'd':
|
---|
1834 | fDaemonize = true;
|
---|
1835 | break;
|
---|
1836 |
|
---|
1837 | case 'Z':
|
---|
1838 | fDaemonized = true;
|
---|
1839 | fDaemonize = false;
|
---|
1840 | break;
|
---|
1841 |
|
---|
1842 | case 'h':
|
---|
1843 | RTPrintf("Usage: to be written\nOption dump:\n");
|
---|
1844 | for (unsigned i = 0; i < RT_ELEMENTS(s_aOptions); i++)
|
---|
1845 | RTPrintf(" -%c,%s\n", s_aOptions[i].iShort, s_aOptions[i].pszLong);
|
---|
1846 | fContinue = false;
|
---|
1847 | break;
|
---|
1848 |
|
---|
1849 | case 'V':
|
---|
1850 | RTPrintf("%sr%d\n", RTBldCfgVersion(), RTBldCfgRevision());
|
---|
1851 | fContinue = false;
|
---|
1852 | break;
|
---|
1853 |
|
---|
1854 | default:
|
---|
1855 | rcExit = RTGetOptPrintError(chOpt, &ValueUnion);
|
---|
1856 | fContinue = false;
|
---|
1857 | break;
|
---|
1858 | }
|
---|
1859 | } while (fContinue);
|
---|
1860 |
|
---|
1861 | if (rcExit == RTEXITCODE_SUCCESS)
|
---|
1862 | {
|
---|
1863 | /*
|
---|
1864 | * Daemonize ourselves if asked to.
|
---|
1865 | */
|
---|
1866 | if (fDaemonize)
|
---|
1867 | {
|
---|
1868 | rc = RTProcDaemonize(papszArgs, "--daemonized");
|
---|
1869 | if (RT_FAILURE(rc))
|
---|
1870 | return RTMsgErrorExit(RTEXITCODE_FAILURE, "RTProcDaemonize: %Rrc\n", rc);
|
---|
1871 | }
|
---|
1872 | else
|
---|
1873 | rcExit = rtFuzzCmdMasterRun(&This, pszLoadCfg);
|
---|
1874 | }
|
---|
1875 | }
|
---|
1876 | else
|
---|
1877 | rcExit = RTMsgErrorExit(RTEXITCODE_SYNTAX, "RTGetOptInit: %Rrc", rc);
|
---|
1878 | return rcExit;
|
---|
1879 | }
|
---|
1880 |
|
---|