// Copyright 2015 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.
package prog
import (
"bytes"
"encoding/hex"
"fmt"
"math/rand"
"strings"
"testing"
"time"
)
func TestGeneration(t *testing.T) {
target, rs, iters := initTest(t)
for i := 0; i < iters; i++ {
target.Generate(rs, 20, nil)
}
}
func TestDefault(t *testing.T) {
target, _, _ := initTest(t)
for _, meta := range target.Syscalls {
ForeachType(meta, func(typ Type) {
arg := typ.makeDefaultArg()
if !isDefault(arg) {
t.Errorf("default arg is not default: %s\ntype: %#v\narg: %#v",
typ, typ, arg)
}
})
}
}
func TestDefaultCallArgs(t *testing.T) {
target, _, _ := initTest(t)
for _, meta := range target.SyscallMap {
// Ensure that we can restore all arguments of all calls.
prog := fmt.Sprintf("%v()", meta.Name)
p, err := target.Deserialize([]byte(prog))
if err != nil {
t.Fatalf("failed to restore default args in prog %q: %v", prog, err)
}
if len(p.Calls) != 1 || p.Calls[0].Meta.Name != meta.Name {
t.Fatalf("restored bad program from prog %q: %q", prog, p.Serialize())
}
}
}
func TestSerialize(t *testing.T) {
target, rs, iters := initTest(t)
for i := 0; i < iters; i++ {
p := target.Generate(rs, 10, nil)
data := p.Serialize()
p1, err := target.Deserialize(data)
if err != nil {
t.Fatalf("failed to deserialize program: %v\n%s", err, data)
}
if p1 == nil {
t.Fatalf("deserialized nil program:\n%s", data)
}
data1 := p1.Serialize()
if len(p.Calls) != len(p1.Calls) {
t.Fatalf("different number of calls")
}
if !bytes.Equal(data, data1) {
t.Fatalf("program changed after serialize/deserialize\noriginal:\n%s\n\nnew:\n%s\n", data, data1)
}
}
}
func TestVmaType(t *testing.T) {
target, rs, iters := initRandomTargetTest(t, "test", "64")
meta := target.SyscallMap["test$vma0"]
r := newRand(target, rs)
pageSize := target.PageSize
for i := 0; i < iters; i++ {
s := newState(target, nil)
calls := r.generateParticularCall(s, meta)
c := calls[len(calls)-1]
if c.Meta.Name != "test$vma0" {
t.Fatalf("generated wrong call %v", c.Meta.Name)
}
if len(c.Args) != 6 {
t.Fatalf("generated wrong number of args %v", len(c.Args))
}
check := func(v, l Arg, min, max uint64) {
va, ok := v.(*PointerArg)
if !ok {
t.Fatalf("vma has bad type: %v", v)
}
la, ok := l.(*ConstArg)
if !ok {
t.Fatalf("len has bad type: %v", l)
}
if va.VmaSize < min || va.VmaSize > max {
t.Fatalf("vma has bad size: %v, want [%v-%v]",
va.VmaSize, min, max)
}
if la.Val < min || la.Val > max {
t.Fatalf("len has bad value: %v, want [%v-%v]",
la.Val, min, max)
}
}
check(c.Args[0], c.Args[1], 1*pageSize, 1e5*pageSize)
check(c.Args[2], c.Args[3], 5*pageSize, 5*pageSize)
check(c.Args[4], c.Args[5], 7*pageSize, 9*pageSize)
}
}
// TestCrossTarget ensures that a program serialized for one arch can be
// deserialized for another arch. This happens when managers exchange
// programs via hub.
func TestCrossTarget(t *testing.T) {
t.Parallel()
const OS = "linux"
var archs []string
for _, target := range AllTargets() {
if target.OS == OS {
archs = append(archs, target.Arch)
}
}
for _, arch := range archs {
target, err := GetTarget(OS, arch)
if err != nil {
t.Fatal(err)
}
var crossTargets []*Target
for _, crossArch := range archs {
if crossArch == arch {
continue
}
crossTarget, err := GetTarget(OS, crossArch)
if err != nil {
t.Fatal(err)
}
crossTargets = append(crossTargets, crossTarget)
}
t.Run(fmt.Sprintf("%v/%v", OS, arch), func(t *testing.T) {
t.Parallel()
testCrossTarget(t, target, crossTargets)
})
}
}
func testCrossTarget(t *testing.T, target *Target, crossTargets []*Target) {
seed := int64(time.Now().UnixNano())
t.Logf("seed=%v", seed)
rs := rand.NewSource(seed)
iters := 100
if testing.Short() {
iters /= 10
}
for i := 0; i < iters; i++ {
p := target.Generate(rs, 20, nil)
testCrossArchProg(t, p, crossTargets)
p, err := target.Deserialize(p.Serialize())
if err != nil {
t.Fatal(err)
}
testCrossArchProg(t, p, crossTargets)
p.Mutate(rs, 20, nil, nil)
testCrossArchProg(t, p, crossTargets)
p, _ = Minimize(p, -1, false, func(*Prog, int) bool {
return rs.Int63()%2 == 0
})
testCrossArchProg(t, p, crossTargets)
}
}
func testCrossArchProg(t *testing.T, p *Prog, crossTargets []*Target) {
serialized := p.Serialize()
for _, crossTarget := range crossTargets {
_, err := crossTarget.Deserialize(serialized)
if err == nil || strings.Contains(err.Error(), "unknown syscall") {
continue
}
t.Fatalf("failed to deserialize for %v/%v: %v\n%s",
crossTarget.OS, crossTarget.Arch, err, serialized)
}
}
func TestSpecialStructs(t *testing.T) {
testEachTargetRandom(t, func(t *testing.T, target *Target, rs rand.Source, iters int) {
for special, gen := range target.SpecialTypes {
t.Run(special, func(t *testing.T) {
var typ Type
for i := 0; i < len(target.Syscalls) && typ == nil; i++ {
ForeachType(target.Syscalls[i], func(t Type) {
if t.Dir() == DirOut {
return
}
if s, ok := t.(*StructType); ok && s.Name() == special {
typ = s
}
if s, ok := t.(*UnionType); ok && s.Name() == special {
typ = s
}
})
}
if typ == nil {
t.Fatal("can't find struct description")
}
g := &Gen{newRand(target, rs), newState(target, nil)}
for i := 0; i < iters/len(target.SpecialTypes); i++ {
arg, _ := gen(g, typ, nil)
gen(g, typ, arg)
}
})
}
})
}
func TestEscapingPaths(t *testing.T) {
paths := map[string]bool{
"/": true,
"/\x00": true,
"/file/..": true,
"/file/../..": true,
"./..": true,
"..": true,
"file/../../file": true,
"../file": true,
"./file/../../file/file": true,
"": false,
".": false,
"file": false,
"./file": false,
"./file/..": false,
}
target, err := GetTarget("test", "64")
if err != nil {
t.Fatal(err)
}
for path, escaping := range paths {
text := fmt.Sprintf("mutate5(&(0x7f0000000000)=\"%s\", 0x0)", hex.EncodeToString([]byte(path)))
_, err := target.Deserialize([]byte(text))
if !escaping && err != nil {
t.Errorf("path %q is detected as escaping (%v)", path, err)
}
if escaping && (err == nil || !strings.Contains(err.Error(), "sandbox escaping file")) {
t.Errorf("path %q is not detected as escaping (%v)", path, err)
}
}
}