#include <gio/gio.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <ctype.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>
#include "dfuzzer.h"
#include "introspection.h"
#include "fuzz.h"
Macros | |
#define | SF1 "./dfuzzer.conf" |
#define | SF2 ".dfuzzer.conf" |
#define | SF3 "/etc/dfuzzer.conf" |
Functions | |
int | main (int argc, char **argv) |
int | df_list_bus_names (const GDBusConnection *dcon) |
int | df_is_object_on_bus (const GDBusConnection *dcon, const char *root_node) |
int | df_traverse_node (const GDBusConnection *dcon, const char *root_node) |
int | df_fuzz (const GDBusConnection *dcon, const char *name, const char *obj, const char *intf) |
int | df_is_valid_dbus (const char *name, const char *obj, const char *intf) |
int | df_open_proc_status_file (const int pid) |
int | df_get_pid (const GDBusConnection *dcon) |
void | df_print_process_info (int pid) |
void | df_parse_parameters (int argc, char **argv) |
int | df_load_suppressions (void) |
void | df_print_help (const char *name) |
void | df_error (const char *message, GError *error) |
void | df_debug (const char *format,...) |
void | df_verbose (const char *format,...) |
void | df_fail (const char *format,...) |
Variables | |
static struct fuzzing_target | target_proc = { "", "", "" } |
static int | df_verbose_flag |
static int | df_debug_flag |
static int | df_list_names |
static long | df_mem_limit |
static long | df_buf_size |
static char * | df_test_method |
static int | df_pid = -1 |
static char * | df_suppression [MAXLEN] |
static char * | df_supp_description [MAXLEN] |
static int | df_supflg |
static char * | df_execute_cmd |
#define SF1 "./dfuzzer.conf" |
Suppression file #1
#define SF2 ".dfuzzer.conf" |
Suppression file #2 (home dir)
#define SF3 "/etc/dfuzzer.conf" |
Suppression file #3 (mandatory)
void df_debug | ( | const char * | format, |
... | |||
) |
Prints debug message.
format | Format string |
void df_error | ( | const char * | message, |
GError * | error | ||
) |
Displays an error message.
message | Error message which will be printed |
error | Pointer on GError structure containing error specification |
void df_fail | ( | const char * | format, |
... | |||
) |
Prints error message.
format | Format string |
int df_fuzz | ( | const GDBusConnection * | dcon, |
const char * | name, | ||
const char * | obj, | ||
const char * | intf | ||
) |
Controls fuzz testing of all methods of specified interface (intf) and reports results.
dcon | D-Bus connection structure |
name | D-Bus name |
obj | D-Bus object path |
intf | D-Bus interface |
int df_get_pid | ( | const GDBusConnection * | dcon | ) |
Calls method GetConnectionUnixProcessID on the interface org.freedesktop.DBus to get process pid.
dcon | D-Bus connection structure |
int df_is_object_on_bus | ( | const GDBusConnection * | dcon, |
const char * | root_node | ||
) |
Traverses through all objects of bus name target_proc.name and is looking for object path target_proc.obj_path
dcon | D-Bus connection structure |
root_node | Starting object path (all nodes from this object path will be traversed) |
Information about nodes in a remote object hierarchy.
int df_is_valid_dbus | ( | const char * | name, |
const char * | obj, | ||
const char * | intf | ||
) |
Checks if name is valid D-Bus name, obj is valid D-Bus object path and intf is valid D-Bus interface.
name | D-Bus name |
obj | D-Bus object path |
intf | D-Bus interface |
int df_list_bus_names | ( | const GDBusConnection * | dcon | ) |
Calls method ListNames to get all available connection names on the bus and prints them on the program output.
dcon | D-Bus connection structure |
int df_load_suppressions | ( | void | ) |
Searches target_proc.name in suppression file SF1, SF2 and SF3 (the file which is opened first is parsed). If it is found, df_suppression array is seeded with names of methods and df_supp_description is seeded with descriptions why methods are skipped (df_suppression array is used to skip methods which it contains when testing target_proc.name). Suppression file is in format: [bus_name] method1 description method2 description [bus_name2] method1 description method2 description ...
int df_open_proc_status_file | ( | const int | pid | ) |
Opens process status file.
pid | PID - identifier of process |
void df_parse_parameters | ( | int | argc, |
char ** | argv | ||
) |
Parses program options and stores them into global variables:
argc | Count of options |
argv | Pointer on strings containing options of program |
void df_print_help | ( | const char * | name | ) |
Prints help.
name | Name of program |
void df_print_process_info | ( | int | pid | ) |
Prints process name and package to which process belongs.
pid | PID of process Note: Any error in this function is suppressed. On error, process name and package is just not printed. |
int df_traverse_node | ( | const GDBusConnection * | dcon, |
const char * | root_node | ||
) |
Traverses through all interfaces and objects of bus name target_proc.name and for each interface it calls df_fuzz() to fuzz test all its methods.
dcon | D-Bus connection structure |
root_node | Starting object path (all nodes from this object path will be traversed) |
Information about nodes in a remote object hierarchy.
Information about a D-Bus interface.
Return values
void df_verbose | ( | const char * | format, |
... | |||
) |
Prints verbose message.
format | Format string |
int main | ( | int | argc, |
char ** | argv | ||
) |
Main function controls fuzzing.
argc | Number of program arguments |
argv | Pointer on string with program arguments |
|
static |
Maximum buffer size for generated strings by rand module (in Bytes)
|
static |
Verbose flag
|
static |
Command/Script to execute by dfuzzer after each method call. If command/script returns >0, dfuzzer prints fail message, if 0 it continues
|
static |
Option for listing names on the bus
|
static |
Memory limit for tested process in kB
|
static |
Tested process PID
|
static |
If -s option is passed 1, otherwise 0
|
static |
NULL terminated array of suppressed method descriptions
|
static |
NULL terminated array of method names which will be skipped from testing
|
static |
Contains method name or NULL. When not NULL, only method with this name will be tested (do not free - points to argv)
|
static |
Debug flag
|
static |
Structure containing D-Bus name, object path and interface of process