params.c

   1 #include <stdio.h>
   2 #include <string.h>
   3 #include <unistd.h>
   4 #include <stdlib.h>
   5 #include <getopt.h>
   6 #include <sys/types.h>
   7 #include <sys/stat.h>
   8
   9 #include "trinity.h"    // progname
  10 #include "random.h"
  11 #include "syscall.h"
  12 #include "log.h"
  13 #include "net.h"
  14 #include "params.h"
  15 #include "protocols.h"
  16 #include "tables.h"
  17
  18 #define TAINT_NAME_LEN 32
  19
  20 bool debug = FALSE;
  21
  22 bool do_specific_syscall = FALSE;
  23 bool do_exclude_syscall = FALSE;
  24
  25 bool do_32_arch = TRUE;
  26 bool do_64_arch = TRUE;
  27
  28 unsigned int specific_proto = 0;
  29 unsigned int user_specified_children = 0;
  30
  31 bool do_specific_proto = FALSE;
  32 bool no_protos[TRINITY_PF_MAX];
  33
  34 bool dopause = FALSE;
  35 bool show_syscall_list = FALSE;
  36 bool show_ioctl_list = FALSE;
  37 unsigned char quiet_level = 0;
  38 bool verbose = FALSE;
  39 bool monochrome = FALSE;
  40 bool dangerous = FALSE;
  41 bool logging = TRUE;
  42 bool do_syslog = FALSE;
  43 bool random_selection = FALSE;
  44 unsigned int random_selection_num;
  45 bool no_files = FALSE;
  46
  47 bool user_set_seed = FALSE;
  48
  49 unsigned char desired_group = GROUP_NONE;
  50
  51 char *specific_proto_optarg;
  52
  53 char *victim_path;
  54
  55 int kernel_taint_initial = 0;
  56 int kernel_taint_mask = 0xFFFFFFFF;
  57 bool kernel_taint_param_occured = FALSE;
  58
  59 static void usage(void)
  60 {
  61         outputerr("%s\n", progname);
  62         outputerr(" --arch, -a: selects syscalls for the specified architecture (32 or 64). Both by default.\n");
  63         outputerr(" --children,-C: specify number of child processes\n");
  64         outputerr(" --exclude,-x: don't call a specific syscall\n");
  65         outputerr(" --group,-g: only run syscalls from a certain group (So far just 'vm').\n");
  66         outputerr(" --ioctls,-I: list all ioctls.\n");
  67         outputerr(" --kernel_taint, -T: controls which kernel taint flags should be considered, for more details refer to README file. \n");
  68         outputerr(" --list,-L: list all syscalls known on this architecture.\n");
  69         outputerr(" --logging,-l: (off=disable logging).\n");
  70         outputerr(" --monochrome,-m: don't output ANSI codes\n");
  71         outputerr(" --no_files,-n: Only pass sockets as fd's, not files\n");
  72         outputerr(" --proto,-P: specify specific network protocol for sockets.\n");
  73         outputerr(" --no_proto,-E: specify network protocols to be excluded from testing.\n");
  74         outputerr(" --quiet,-q: less output.\n");
  75         outputerr(" --random,-r#: pick N syscalls at random and just fuzz those\n");
  76         outputerr(" --syslog,-S: log important info to syslog. (useful if syslog is remote)\n");
  77         outputerr(" --verbose,-v: increase output verbosity.\n");
  78         outputerr(" --victims,-V: path to victim files.\n");
  79         outputerr("\n");
  80         outputerr(" -c#,@: target specific syscall (takes syscall name as parameter and optionally 32 or 64 as bit-width. Default:both).\n");
  81         outputerr(" -N#: do # syscalls then exit.\n");
  82         outputerr(" -p:  pause after syscall.\n");
  83         outputerr(" -s#: use # as random seed.\n");
  84         exit(EXIT_SUCCESS);
  85 }
  86
  87 static const struct option longopts[] = {
  88         { "children", required_argument, NULL, 'C' },
  89         { "dangerous", no_argument, NULL, 'd' },
  90         { "debug", no_argument, NULL, 'D' },
  91         { "exclude", required_argument, NULL, 'x' },
  92         { "group", required_argument, NULL, 'g' },
  93         { "kernel_taint", required_argument, NULL, 'T' },
  94         { "help", no_argument, NULL, 'h' },
  95         { "list", no_argument, NULL, 'L' },
  96         { "ioctls", no_argument, NULL, 'I' },
  97         { "logging", required_argument, NULL, 'l' },
  98         { "monochrome", no_argument, NULL, 'm' },
  99         { "no_files", no_argument, NULL, 'n' },
 100         { "proto", required_argument, NULL, 'P' },
 101         { "no_proto", required_argument, NULL, 'E' },
 102         { "random", required_argument, NULL, 'r' },
 103         { "quiet", no_argument, NULL, 'q' },
 104         { "syslog", no_argument, NULL, 'S' },
 105         { "victims", required_argument, NULL, 'V' },
 106         { "verbose", no_argument, NULL, 'v' },
 107         { "arch", required_argument, NULL, 'a' },
 108         { NULL, 0, NULL, 0 } };
 109
 110 static void toggle_taint_flag(int bit) {
 111         kernel_taint_mask |= (1 << bit);
 112 }
 113
 114 static void toggle_taint_flag_by_name(char *beg, char *end) {
 115         char flagname[TAINT_NAME_LEN];
 116         char *name;
 117         int maxlen;
 118
 119         if (end == NULL) {
 120                 name = beg;
 121         } else {
 122                 name = flagname;
 123                 maxlen = end - beg;
 124                 if (maxlen > (TAINT_NAME_LEN - 1))
 125                         maxlen = TAINT_NAME_LEN - 1;
 126                 strncpy(flagname, beg, maxlen);
 127                 flagname[maxlen] = 0;
 128         }
 129
 130         if (strcmp(name,"PROPRIETARY_MODULE") == 0)
 131                 toggle_taint_flag(TAINT_PROPRIETARY_MODULE);
 132         else if (strcmp(name,"FORCED_MODULE") == 0)
 133                 toggle_taint_flag(TAINT_FORCED_MODULE);
 134         else if (strcmp(name,"UNSAFE_SMP") == 0)
 135                 toggle_taint_flag(TAINT_UNSAFE_SMP);
 136         else if (strcmp(name,"FORCED_RMMOD") == 0)
 137                 toggle_taint_flag(TAINT_FORCED_RMMOD);
 138         else if (strcmp(name,"MACHINE_CHECK") == 0)
 139                 toggle_taint_flag(TAINT_MACHINE_CHECK);
 140         else if (strcmp(name,"BAD_PAGE") == 0)
 141                 toggle_taint_flag(TAINT_BAD_PAGE);
 142         else if (strcmp(name,"USER") == 0)
 143                 toggle_taint_flag(TAINT_USER);
 144         else if (strcmp(name,"DIE") == 0)
 145                 toggle_taint_flag(TAINT_DIE);
 146         else if (strcmp(name,"OVERRIDDEN_ACPI_TABLE") == 0)
 147                 toggle_taint_flag(TAINT_OVERRIDDEN_ACPI_TABLE);
 148         else if (strcmp(name,"WARN") == 0)
 149                 toggle_taint_flag(TAINT_WARN);
 150         else if (strcmp(name,"CRAP") == 0)
 151                 toggle_taint_flag(TAINT_CRAP);
 152         else if (strcmp(name,"FIRMWARE_WORKAROUND") == 0)
 153                 toggle_taint_flag(TAINT_FIRMWARE_WORKAROUND);
 154         else if (strcmp(name,"OOT_MODULE") == 0)
 155                 toggle_taint_flag(TAINT_OOT_MODULE);
 156         else {
 157                 outputerr("Unrecognizable kernel taint flag \"%s\".\n", name);
 158                 exit(EXIT_FAILURE);
 159         }
 160 }
 161
 162 static void process_taint_arg(char *taintarg) {
 163         char *beg, *end;
 164
 165         if (kernel_taint_param_occured == FALSE) {
 166                 kernel_taint_param_occured = TRUE;
 167                 kernel_taint_mask = 0; //We now only care about flags that user specified.
 168         }
 169
 170         beg = taintarg;
 171         end = strchr(beg, ',');
 172         while(end != NULL) {
 173                 toggle_taint_flag_by_name(beg,end);
 174                 beg = end + 1;
 175                 end = strchr(beg, ',');
 176         }
 177         toggle_taint_flag_by_name(beg,end);
 178 }
 179
 180 void parse_args(int argc, char *argv[])
 181 {
 182         int opt;
 183
 184         while ((opt = getopt_long(argc, argv, "a:c:C:dDg:hIl:LN:mnP:E:pqr:s:T:SV:vx:", longopts, NULL)) != -1) {
 185                 switch (opt) {
 186                 default:
 187                         if (opt == '?')
 188                                 exit(EXIT_FAILURE);
 189                         else
 190                                 outputstd("opt:%c\n", opt);
 191                         return;
 192
 193                 case '\0':
 194                         return;
 195
 196                 case 'c':
 197                         /* syscalls are all disabled at this point. enable the syscall we care about. */
 198                         do_specific_syscall = TRUE;
 199                         toggle_syscall(optarg, TRUE);
 200                         break;
 201
 202                 case 'a':
 203                         /* One of the architectures selected*/
 204                         do_32_arch = FALSE;
 205                         do_64_arch = FALSE;
 206                         if (strcmp(optarg, "64") == 0)
 207                                 do_64_arch = TRUE;
 208                         else if (strcmp(optarg, "32") == 0)
 209                                 do_32_arch = TRUE;
 210                         else
 211                                 exit(EXIT_FAILURE);
 212
 213                         break;
 214
 215                 case 'C':
 216                         user_specified_children = strtoll(optarg, NULL, 10);
 217                         break;
 218
 219                 case 'd':
 220                         dangerous = 1;
 221                         break;
 222
 223                 case 'D':
 224                         debug = 1;
 225                         break;
 226
 227                 case 'g':
 228                         if (!strcmp(optarg, "vm"))
 229                                 desired_group = GROUP_VM;
 230                         if (!strcmp(optarg, "vfs"))
 231                                 desired_group = GROUP_VFS;
 232                         break;
 233
 234                 /* Show help */
 235                 case 'h':
 236                         usage();
 237                         exit(EXIT_SUCCESS);
 238
 239                 case 'I':
 240                         show_ioctl_list = TRUE;
 241                         break;
 242
 243                 case 'l':
 244                         if (!strcmp(optarg, "off"))
 245                                 logging = 0;
 246                         break;
 247
 248                 case 'L':
 249                         show_syscall_list = TRUE;
 250                         break;
 251
 252                 case 'm':
 253                         monochrome = TRUE;
 254                         break;
 255
 256                 case 'n':
 257                         no_files = TRUE;
 258                         break;
 259
 260                 /* Set number of syscalls to do */
 261                 case 'N':
 262                         syscalls_todo = strtoll(optarg, NULL, 10);
 263                         break;
 264
 265                 /* Pause after each syscall */
 266                 case 'p':
 267                         dopause = 1;
 268                         break;
 269
 270                 case 'P':
 271                         do_specific_proto = 1;
 272                         specific_proto = strtol(optarg, NULL, 10);
 273                         specific_proto_optarg = optarg;
 274                         break;
 275
 276                 case 'E':
 277                         parse_exclude_protos(optarg);
 278                         break;
 279
 280                 case 'q':
 281                         quiet_level++;
 282                         break;
 283
 284                 case 'r':
 285                         if (do_exclude_syscall == TRUE) {
 286                                 outputerr("-r needs to be before any -x options.\n");
 287                                 exit(EXIT_FAILURE);
 288                         }
 289                         random_selection = 1;
 290                         random_selection_num = strtol(optarg, NULL, 10);
 291                         break;
 292
 293                 /* Set seed */
 294                 case 's':
 295                         seed = strtol(optarg, NULL, 10);
 296                         user_set_seed = TRUE;
 297                         break;
 298
 299
 300                 case 'S':
 301                         do_syslog = TRUE;
 302                         break;
 303
 304                 case 'T':
 305                         //Load mask for kernel taint flags.
 306                         process_taint_arg(optarg);
 307                         break;
 308
 309                 case 'v':
 310                         verbose = TRUE;
 311                         break;
 312
 313                 case 'V':
 314                         victim_path = strdup(optarg);
 315                         //FIXME: Later, allow for multiple victim files
 316                         break;
 317
 318                 case 'x':
 319                         do_exclude_syscall = TRUE;
 320                         toggle_syscall(optarg, FALSE);
 321                         break;
 322                 }
 323         }
 324         if (quiet_level > MAX_LOGLEVEL)
 325                 quiet_level = MAX_LOGLEVEL;
 326
 327         quiet_level = MAX_LOGLEVEL - quiet_level;
 328 }