static unsigned long fill_arg(struct syscallrecord *rec, unsigned int argnum)
{
struct syscallentry *entry;
unsigned int call;
enum argtype argtype;
call = rec->nr;
entry = syscalls[call].entry;
if (argnum > entry->num_args)
return 0;
argtype = get_argtype(entry, argnum);
switch (argtype) {
case ARG_UNDEFINED:
if (RAND_BOOL())
return (unsigned long) rand64();
return (unsigned long) get_writable_address(page_size);
case ARG_FD:
if (RAND_BOOL()) {
unsigned int i;
/* If this is the 2nd or more ARG_FD, make it unique */
for (i = 0; i < argnum; i++) {
enum argtype arg;
arg = get_argtype(entry, i);
if (arg == ARG_FD)
return get_new_random_fd();
}
}
return get_random_fd();
case ARG_LEN:
return (unsigned long) get_len();
case ARG_ADDRESS:
return handle_arg_address(rec, argnum);
case ARG_NON_NULL_ADDRESS:
return (unsigned long) get_non_null_address();
case ARG_MMAP:
return (unsigned long) get_map();
case ARG_PID:
return (unsigned long) get_pid();
case ARG_RANGE:
return handle_arg_range(entry, argnum);
case ARG_OP: /* Like ARG_LIST, but just a single value. */
return handle_arg_op(entry, argnum);
case ARG_LIST:
return handle_arg_list(entry, argnum);
case ARG_CPU:
return (unsigned long) get_cpu();
case ARG_PATHNAME:
return (unsigned long) generate_pathname();
case ARG_IOVEC:
return handle_arg_iovec(entry, rec, argnum);
case ARG_IOVECLEN:
case ARG_SOCKADDRLEN:
/* We already set the len in the ARG_IOVEC/ARG_SOCKADDR case
* So here we just return what we had set there. */
return get_argval(rec, argnum);
case ARG_SOCKADDR:
return handle_arg_sockaddr(entry, rec, argnum);
case ARG_MODE_T:
return handle_arg_mode_t();
case ARG_SOCKETINFO:
return (unsigned long) get_rand_socketinfo();
}
BUG("unreachable!\n");
}
static void socket_destructor(struct object *obj)
{
struct socketinfo *si = &obj->sockinfo;
struct linger ling = { .l_onoff = FALSE, .l_linger = 0 };
int fd;
//FIXME: This is a workaround for a weird bug where we hang forevre
// waiting for bluetooth sockets when we setsockopt.
// Hopefully at some point we can remove this when someone figures out what's going on.
if (si->triplet.family == PF_BLUETOOTH)
return;
/* Grab an fd, and nuke it before someone else uses it. */
fd = si->fd;
si->fd = 0;
/* disable linger */
(void) setsockopt(fd, SOL_SOCKET, SO_LINGER, &ling, sizeof(struct linger));
(void) shutdown(fd, SHUT_RDWR);
if (close(fd) != 0)
output(1, "failed to close socket [%d:%d:%d].(%s)\n",
si->triplet.family,
si->triplet.type,
si->triplet.protocol,
strerror(errno));
}
static void socket_dump(struct object *obj, bool global)
{
struct socketinfo *si = &obj->sockinfo;
struct msg_objcreatedsocket objmsg;
output(2, "socket fd:%d domain:%u (%s) type:0x%u protocol:%u\n",
si->fd, si->triplet.family, get_domain_name(si->triplet.family),
si->triplet.type, si->triplet.protocol);
init_msgobjhdr(&objmsg.hdr, OBJ_CREATED_SOCKET, global, obj);
objmsg.si.fd = si->fd;
objmsg.si.triplet.family = si->triplet.family;
objmsg.si.triplet.type = si->triplet.type;
objmsg.si.triplet.protocol = si->triplet.protocol;
sendudp((char *) &objmsg, sizeof(objmsg));
}
static int open_sockets(void)
{
struct objhead *head;
int bytesread = -1;
int ret;
head = get_objhead(OBJ_GLOBAL, OBJ_FD_SOCKET);
head->destroy = &socket_destructor;
head->dump = &socket_dump;
cachefile = open(cachefilename, O_RDONLY);
if (cachefile < 0) {
output(1, "Couldn't find socket cachefile. Regenerating.\n");
ret = generate_sockets();
output(1, "created %d sockets\n", nr_sockets);
return ret;
}
lock_cachefile(F_RDLCK);
while (bytesread != 0) {
unsigned int domain, type, protocol;
unsigned int buffer[3];
int fd;
bytesread = read(cachefile, buffer, sizeof(int) * 3);
if (bytesread == 0) {
if (nr_sockets == 0)
goto regenerate;
break;
}
domain = buffer[0];
type = buffer[1];
protocol = buffer[2];
if (domain >= TRINITY_PF_MAX) {
output(1, "cachefile contained invalid domain %u\n", domain);
goto regenerate;
}
if ((do_specific_domain == TRUE && domain != specific_domain) ||
(no_domains[domain] == TRUE)) {
output(1, "ignoring socket cachefile due to specific "
"protocol request (or protocol disabled), "
"and stale data in cachefile.\n");
regenerate:
unlock_cachefile(); /* drop the reader lock. */
close(cachefile);
unlink(cachefilename);
ret = generate_sockets();
return ret;
}
fd = open_socket(domain, type, protocol);
if (fd < 0) {
output(1, "Cachefile is stale. Need to regenerate.\n");
goto regenerate;
}
/* check for ctrl-c */
if (shm->exit_reason != STILL_RUNNING) {
close(cachefile);
return FALSE;
}
}
output(1, "%d sockets created based on info from socket cachefile.\n", nr_sockets);
unlock_cachefile();
close(cachefile);
return TRUE;
}
struct socketinfo * get_rand_socketinfo(void)
{
struct object *obj;
/* When using victim files, sockets can be 0. */
if (objects_empty(OBJ_FD_SOCKET) == TRUE)
return NULL;
obj = get_random_object(OBJ_FD_SOCKET, OBJ_GLOBAL);
return &obj->sockinfo;
}
static int get_rand_socket_fd(void)
{
struct socketinfo *sockinfo;
sockinfo = get_rand_socketinfo();
if (sockinfo == NULL)
return -1;
return sockinfo->fd;
}
int fd_from_socketinfo(struct socketinfo *si)
{
if (si != NULL) {
if (!(ONE_IN(1000)))
return si->fd;
}
return get_random_fd();
}
static const struct fd_provider socket_fd_provider = {
.name = "sockets",
.enabled = TRUE,
.open = &open_sockets,
.get = &get_rand_socket_fd,
};
REG_FD_PROV(socket_fd_provider);
