corrupt.c 11.3 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32
/* Regression test for being disconnected by a corrupt message (fd.o #15578)
 *
 * Author: Simon McVittie <simon.mcvittie@collabora.co.uk>
 * Copyright © 2010-2011 Nokia Corporation
 *
 * Permission is hereby granted, free of charge, to any person
 * obtaining a copy of this software and associated documentation files
 * (the "Software"), to deal in the Software without restriction,
 * including without limitation the rights to use, copy, modify, merge,
 * publish, distribute, sublicense, and/or sell copies of the Software,
 * and to permit persons to whom the Software is furnished to do so,
 * subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be
 * included in all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 * SOFTWARE.
 */

#include <config.h>

#include <glib.h>
#include <gio/gio.h>

#include <dbus/dbus.h>
33

34
#include "test-utils-glib.h"
35 36 37

typedef struct {
    DBusError e;
38
    TestMainContext *ctx;
39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76

    DBusServer *server;
    DBusConnection *server_conn;
    /* queue of DBusMessage */
    GQueue client_messages;

    DBusConnection *client_conn;
} Fixture;

static void
assert_no_error (const DBusError *e)
{
  if (G_UNLIKELY (dbus_error_is_set (e)))
    g_error ("expected success but got error: %s: %s", e->name, e->message);
}

static DBusHandlerResult
client_message_cb (DBusConnection *client_conn,
    DBusMessage *message,
    void *data)
{
  Fixture *f = data;

  g_assert (client_conn == f->client_conn);
  g_queue_push_tail (&f->client_messages, dbus_message_ref (message));

  return DBUS_HANDLER_RESULT_HANDLED;
}

static void
new_conn_cb (DBusServer *server,
    DBusConnection *server_conn,
    void *data)
{
  Fixture *f = data;

  g_assert (f->server_conn == NULL);
  f->server_conn = dbus_connection_ref (server_conn);
77
  test_connection_setup (f->ctx, server_conn);
78 79 80 81 82 83
}

static void
setup (Fixture *f,
    gconstpointer addr)
{
84
  f->ctx = test_main_context_get ();
85 86 87 88 89 90 91 92 93
  dbus_error_init (&f->e);
  g_queue_init (&f->client_messages);

  f->server = dbus_server_listen (addr, &f->e);
  assert_no_error (&f->e);
  g_assert (f->server != NULL);

  dbus_server_set_new_connection_function (f->server,
      new_conn_cb, f, NULL);
94
  test_server_setup (f->ctx, f->server);
95 96 97 98 99 100 101
}

static void
test_connect (Fixture *f,
    gconstpointer addr G_GNUC_UNUSED)
{
  dbus_bool_t have_mem;
102
  char *address = NULL;
103 104 105

  g_assert (f->server_conn == NULL);

106 107
  address = dbus_server_get_address (f->server);
  f->client_conn = dbus_connection_open_private (address, &f->e);
108 109
  assert_no_error (&f->e);
  g_assert (f->client_conn != NULL);
110
  test_connection_setup (f->ctx, f->client_conn);
111
  dbus_free (address);
112 113 114

  while (f->server_conn == NULL)
    {
115
      test_progress ('.');
116
      test_main_context_iterate (f->ctx, TRUE);
117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143
    }

  have_mem = dbus_connection_add_filter (f->client_conn,
      client_message_cb, f, NULL);
  g_assert (have_mem);
}

static void
test_message (Fixture *f,
    gconstpointer addr)
{
  dbus_bool_t have_mem;
  dbus_uint32_t serial;
  DBusMessage *outgoing, *incoming;

  test_connect (f, addr);

  outgoing = dbus_message_new_signal ("/com/example/Hello",
      "com.example.Hello", "Greeting");
  g_assert (outgoing != NULL);

  have_mem = dbus_connection_send (f->server_conn, outgoing, &serial);
  g_assert (have_mem);
  g_assert (serial != 0);

  while (g_queue_is_empty (&f->client_messages))
    {
144
      test_progress ('.');
145
      test_main_context_iterate (f->ctx, TRUE);
146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167
    }

  g_assert_cmpuint (g_queue_get_length (&f->client_messages), ==, 1);

  incoming = g_queue_pop_head (&f->client_messages);

  g_assert (!dbus_message_contains_unix_fds (incoming));
  g_assert_cmpstr (dbus_message_get_destination (incoming), ==, NULL);
  g_assert_cmpstr (dbus_message_get_error_name (incoming), ==, NULL);
  g_assert_cmpstr (dbus_message_get_interface (incoming), ==,
      "com.example.Hello");
  g_assert_cmpstr (dbus_message_get_member (incoming), ==, "Greeting");
  g_assert_cmpstr (dbus_message_get_sender (incoming), ==, NULL);
  g_assert_cmpstr (dbus_message_get_signature (incoming), ==, "");
  g_assert_cmpstr (dbus_message_get_path (incoming), ==, "/com/example/Hello");
  g_assert_cmpuint (dbus_message_get_serial (incoming), ==, serial);

  dbus_message_unref (incoming);

  dbus_message_unref (outgoing);
}

168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199
static void
send_n_bytes (GSocket *socket,
              const gchar *blob,
              gssize blob_len)
{
  gssize len, total_sent;
  GError *gerror = NULL;

  total_sent = 0;

  while (total_sent < blob_len)
    {
      len = g_socket_send (socket,
                           blob + total_sent,
                           blob_len - total_sent,
                           NULL, &gerror);

      /* this is NULL-safe: a NULL error does not match */
      if (g_error_matches (gerror, G_IO_ERROR, G_IO_ERROR_WOULD_BLOCK))
        {
          /* we could wait for G_IO_OUT, but life's too short; just sleep */
          g_clear_error (&gerror);
          g_usleep (G_USEC_PER_SEC / 10);
          continue;
        }

      g_assert_no_error (gerror);
      g_assert (len >= 0);
      total_sent += len;
    }
}

200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229
/* Enough bytes for it to be obvious that this connection is broken */
#define CORRUPT_LEN 1024

/* All-zero is not a valid D-Bus message header - for a start, this is
 * protocol version 1, not 0 */
static const gchar not_a_dbus_message[CORRUPT_LEN] = { 0 };

static void
test_corrupt (Fixture *f,
    gconstpointer addr)
{
  GSocket *socket;
  GError *gerror = NULL;
  int fd;
  DBusMessage *incoming;

  test_message (f, addr);

  dbus_connection_flush (f->server_conn);

  /* OK, now the connection is working, let's break it! Don't try this
   * at home; splicing arbitrary bytes into the middle of the stream is
   * specifically documented as not a valid thing to do. Who'd have thought? */
  if (!dbus_connection_get_socket (f->server_conn, &fd))
    g_error ("failed to steal fd from server connection");

  socket = g_socket_new_from_fd (fd, &gerror);
  g_assert_no_error (gerror);
  g_assert (socket != NULL);

230
  send_n_bytes (socket, not_a_dbus_message, CORRUPT_LEN);
231 232 233 234 235

  /* Now spin on the client connection: the server just sent it complete
   * rubbish, so it should disconnect */
  while (g_queue_is_empty (&f->client_messages))
    {
236
      test_progress ('.');
237
      test_main_context_iterate (f->ctx, TRUE);
238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253
    }

  incoming = g_queue_pop_head (&f->client_messages);

  g_assert (!dbus_message_contains_unix_fds (incoming));
  g_assert_cmpstr (dbus_message_get_destination (incoming), ==, NULL);
  g_assert_cmpstr (dbus_message_get_error_name (incoming), ==, NULL);
  g_assert_cmpstr (dbus_message_get_interface (incoming), ==,
      "org.freedesktop.DBus.Local");
  g_assert_cmpstr (dbus_message_get_member (incoming), ==, "Disconnected");
  g_assert_cmpstr (dbus_message_get_sender (incoming), ==, NULL);
  g_assert_cmpstr (dbus_message_get_signature (incoming), ==, "");
  g_assert_cmpstr (dbus_message_get_path (incoming), ==,
      "/org/freedesktop/DBus/Local");

  dbus_message_unref (incoming);
254 255 256 257 258 259 260 261 262 263

  /* Free the DBusConnection before the GSocket, because GSocket is
   * going to close our fd. GSocket tolerates closing an already-closed
   * fd, whereas DBusLoop + DBusSocketSetEpoll doesn't. On Unix
   * we could use dup() but that isn't portable to Windows :-(
   */
  dbus_connection_close (f->server_conn);
  dbus_connection_unref (f->server_conn);
  f->server_conn = NULL;

264
  g_object_unref (socket);
265 266
}

267 268 269 270 271 272 273 274 275
static void
test_byte_order (Fixture *f,
    gconstpointer addr)
{
  GSocket *socket;
  GError *gerror = NULL;
  int fd;
  char *blob;
  const gchar *arg = not_a_dbus_message;
276
  int blob_len;
277 278 279 280 281 282 283 284 285 286
  DBusMessage *message;
  dbus_bool_t mem;

  test_message (f, addr);

  message = dbus_message_new_signal ("/", "a.b", "c");
  g_assert (message != NULL);
  /* Append 0xFF bytes, so that the length of the body when byte-swapped
   * is 0xFF000000, which is invalid */
  mem = dbus_message_append_args (message,
287
      DBUS_TYPE_ARRAY, DBUS_TYPE_BYTE, &arg, 0xFF,
288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315
      DBUS_TYPE_INVALID);
  g_assert (mem);
  mem = dbus_message_marshal (message, &blob, &blob_len);
  g_assert (mem);
  g_assert_cmpuint (blob_len, >, 0xFF);
  g_assert (blob != NULL);

  dbus_message_unref (message);

  /* Break the message by changing its claimed byte order, without actually
   * byteswapping anything. We happen to know that byte order is the first
   * byte. */
  if (blob[0] == 'B')
    blob[0] = 'l';
  else
    blob[0] = 'B';

  /* OK, now the connection is working, let's break it */

  dbus_connection_flush (f->server_conn);

  if (!dbus_connection_get_socket (f->server_conn, &fd))
    g_error ("failed to steal fd from server connection");

  socket = g_socket_new_from_fd (fd, &gerror);
  g_assert_no_error (gerror);
  g_assert (socket != NULL);

316
  send_n_bytes (socket, blob, blob_len);
317 318 319 320 321 322 323

  dbus_free (blob);

  /* Now spin on the client connection: the server just sent it a faulty
   * message, so it should disconnect */
  while (g_queue_is_empty (&f->client_messages))
    {
324
      test_progress ('.');
325
      test_main_context_iterate (f->ctx, TRUE);
326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341
    }

  message = g_queue_pop_head (&f->client_messages);

  g_assert (!dbus_message_contains_unix_fds (message));
  g_assert_cmpstr (dbus_message_get_destination (message), ==, NULL);
  g_assert_cmpstr (dbus_message_get_error_name (message), ==, NULL);
  g_assert_cmpstr (dbus_message_get_interface (message), ==,
      "org.freedesktop.DBus.Local");
  g_assert_cmpstr (dbus_message_get_member (message), ==, "Disconnected");
  g_assert_cmpstr (dbus_message_get_sender (message), ==, NULL);
  g_assert_cmpstr (dbus_message_get_signature (message), ==, "");
  g_assert_cmpstr (dbus_message_get_path (message), ==,
      "/org/freedesktop/DBus/Local");

  dbus_message_unref (message);
342 343 344 345 346 347

  /* Free the DBusConnection before the GSocket, as above. */
  dbus_connection_close (f->server_conn);
  dbus_connection_unref (f->server_conn);
  f->server_conn = NULL;

348
  g_object_unref (socket);
349 350
}

351 352 353 354 355 356
static void
teardown (Fixture *f,
    gconstpointer addr G_GNUC_UNUSED)
{
  if (f->client_conn != NULL)
    {
357
      test_connection_shutdown (f->ctx, f->client_conn);
358 359 360 361 362 363 364
      dbus_connection_close (f->client_conn);
      dbus_connection_unref (f->client_conn);
      f->client_conn = NULL;
    }

  if (f->server_conn != NULL)
    {
365
      test_connection_shutdown (f->ctx, f->server_conn);
366 367 368 369 370 371 372 373 374 375 376
      dbus_connection_close (f->server_conn);
      dbus_connection_unref (f->server_conn);
      f->server_conn = NULL;
    }

  if (f->server != NULL)
    {
      dbus_server_disconnect (f->server);
      dbus_server_unref (f->server);
      f->server = NULL;
    }
377 378

  test_main_context_unref (f->ctx);
379 380 381 382 383 384
}

int
main (int argc,
    char **argv)
{
385
  test_init (&argc, &argv);
386 387 388 389 390 391 392 393 394

  g_test_add ("/corrupt/tcp", Fixture, "tcp:host=127.0.0.1", setup,
      test_corrupt, teardown);

#ifdef DBUS_UNIX
  g_test_add ("/corrupt/unix", Fixture, "unix:tmpdir=/tmp", setup,
      test_corrupt, teardown);
#endif

395 396 397
  g_test_add ("/corrupt/byte-order/tcp", Fixture, "tcp:host=127.0.0.1", setup,
      test_byte_order, teardown);

398 399
  return g_test_run ();
}