#include "config.h" #define LIBSSH_STATIC #include "torture.h" #define DEBUG_BUFFER #include "buffer.c" #define LIMIT (8*1024*1024) static int setup(void **state) { ssh_buffer buffer; buffer = ssh_buffer_new(); if (buffer == NULL) { return -1; } ssh_buffer_set_secure(buffer); *state = (void *) buffer; return 0; } static int teardown(void **state) { SSH_BUFFER_FREE(*state); return 0; } /* * Test if the continuously growing buffer size never exceeds 2 time its * real capacity */ static void torture_growing_buffer(void **state) { ssh_buffer buffer = *state; int i; for(i=0;i<LIMIT;++i){ ssh_buffer_add_data(buffer,"A",1); if(buffer->used >= 128){ if(ssh_buffer_get_len(buffer) * 2 < buffer->allocated){ assert_true(ssh_buffer_get_len(buffer) * 2 >= buffer->allocated); } } } } /* * Test if the continuously growing buffer size never exceeds 2 time its * real capacity, when we remove 1 byte after each call (sliding window) */ static void torture_growing_buffer_shifting(void **state) { ssh_buffer buffer = *state; int i; unsigned char c; for(i=0; i<1024;++i){ ssh_buffer_add_data(buffer,"S",1); } for(i=0;i<LIMIT;++i){ ssh_buffer_get_u8(buffer,&c); ssh_buffer_add_data(buffer,"A",1); if(buffer->used >= 128){ if(ssh_buffer_get_len(buffer) * 4 < buffer->allocated){ assert_true(ssh_buffer_get_len(buffer) * 4 >= buffer->allocated); return; } } } } /* * Test the behavior of ssh_buffer_prepend_data */ static void torture_buffer_prepend(void **state) { ssh_buffer buffer = *state; uint32_t v; ssh_buffer_add_data(buffer,"abcdef",6); ssh_buffer_prepend_data(buffer,"xyz",3); assert_int_equal(ssh_buffer_get_len(buffer),9); assert_memory_equal(ssh_buffer_get(buffer), "xyzabcdef", 9); /* Now remove 4 bytes and see if we can replace them */ ssh_buffer_get_u32(buffer,&v); assert_int_equal(ssh_buffer_get_len(buffer),5); assert_memory_equal(ssh_buffer_get(buffer), "bcdef", 5); ssh_buffer_prepend_data(buffer,"aris",4); assert_int_equal(ssh_buffer_get_len(buffer),9); assert_memory_equal(ssh_buffer_get(buffer), "arisbcdef", 9); /* same thing but we add 5 bytes now */ ssh_buffer_get_u32(buffer,&v); assert_int_equal(ssh_buffer_get_len(buffer),5); assert_memory_equal(ssh_buffer_get(buffer), "bcdef", 5); ssh_buffer_prepend_data(buffer,"12345",5); assert_int_equal(ssh_buffer_get_len(buffer),10); assert_memory_equal(ssh_buffer_get(buffer), "12345bcdef", 10); } /* * Test the behavior of ssh_buffer_get_ssh_string with invalid data */ static void torture_ssh_buffer_get_ssh_string(void **state) { ssh_buffer buffer; int i,j,k,l, rc; /* some values that can go wrong */ uint32_t values[] = {0xffffffff, 0xfffffffe, 0xfffffffc, 0xffffff00, 0x80000000, 0x80000004, 0x7fffffff}; char data[128]; (void)state; memset(data,'X',sizeof(data)); for(i=0; i < (int)(sizeof(values)/sizeof(values[0]));++i){ for(j=0; j< (int)sizeof(data);++j){ for(k=1;k<5;++k){ buffer = ssh_buffer_new(); assert_non_null(buffer); for(l=0;l<k;++l){ rc = ssh_buffer_add_u32(buffer,htonl(values[i])); assert_int_equal(rc, 0); } rc = ssh_buffer_add_data(buffer,data,j); assert_int_equal(rc, 0); for(l=0;l<k;++l){ ssh_string str = ssh_buffer_get_ssh_string(buffer); assert_null(str); SSH_STRING_FREE(str); } SSH_BUFFER_FREE(buffer); } } } } static void torture_ssh_buffer_add_format(void **state) { ssh_buffer buffer=*state; uint8_t b; uint16_t w; uint32_t d; uint64_t q; ssh_string s; int rc; size_t len; uint8_t verif[]="\x42\x13\x37\x0b\xad\xc0\xde\x13\x24\x35\x46" "\xac\xbd\xce\xdf" "\x00\x00\x00\x06" "libssh" "\x00\x00\x00\x05" "rocks" "So much" "Fun!"; b=0x42; w=0x1337; d=0xbadc0de; q=0x13243546acbdcedf; s=ssh_string_from_char("libssh"); rc=ssh_buffer_pack(buffer, "bwdqSsPt",b,w,d,q,s,"rocks",7,"So much","Fun!"); assert_int_equal(rc, SSH_OK); len = ssh_buffer_get_len(buffer); assert_int_equal(len, sizeof(verif) - 1); assert_memory_equal(ssh_buffer_get(buffer), verif, sizeof(verif) -1); SSH_STRING_FREE(s); } static void torture_ssh_buffer_get_format(void **state) { ssh_buffer buffer=*state; uint8_t b=0; uint16_t w=0; uint32_t d=0; uint64_t q=0; ssh_string s=NULL; char *s1=NULL, *s2=NULL; int rc; size_t len; uint8_t verif[]="\x42\x13\x37\x0b\xad\xc0\xde\x13\x24\x35\x46" "\xac\xbd\xce\xdf" "\x00\x00\x00\x06" "libssh" "\x00\x00\x00\x05" "rocks" "So much"; rc = ssh_buffer_add_data(buffer, verif, sizeof(verif) - 1); assert_int_equal(rc, SSH_OK); rc = ssh_buffer_unpack(buffer, "bwdqSsP",&b,&w,&d,&q,&s,&s1,(size_t)7,&s2); assert_int_equal(rc, SSH_OK); assert_int_equal(b, 0x42); assert_int_equal(w, 0x1337); assert_true(d == 0xbadc0de); assert_true(q == 0x13243546acbdcedf); assert_non_null(s); assert_int_equal(ssh_string_len(s), 6); assert_memory_equal(ssh_string_data(s), "libssh", 6); assert_non_null(s1); assert_string_equal(s1, "rocks"); assert_non_null(s2); assert_memory_equal(s2, "So much", 7); len = ssh_buffer_get_len(buffer); assert_int_equal(len, 0); SAFE_FREE(s); SAFE_FREE(s1); SAFE_FREE(s2); } static void torture_ssh_buffer_get_format_error(void **state) { ssh_buffer buffer=*state; uint8_t b=0; uint16_t w=0; uint32_t d=0; uint64_t q=0; ssh_string s=NULL; char *s1=NULL, *s2=NULL; int rc; uint8_t verif[]="\x42\x13\x37\x0b\xad\xc0\xde\x13\x24\x35\x46" "\xac\xbd\xce\xdf" "\x00\x00\x00\x06" "libssh" "\x00\x00\x00\x05" "rocks" "So much"; rc = ssh_buffer_add_data(buffer, verif, sizeof(verif) - 1); assert_int_equal(rc, SSH_OK); rc = ssh_buffer_unpack(buffer, "bwdqSsPb",&b,&w,&d,&q,&s,&s1,(size_t)7,&s2,&b); assert_int_equal(rc, SSH_ERROR); assert_null(s); assert_null(s1); assert_null(s2); } static void torture_buffer_pack_badformat(void **state){ ssh_buffer buffer = *state; uint8_t b = 42; int rc; /* first with missing format */ rc = ssh_buffer_pack(buffer, "b", b, b); assert_int_equal(rc, SSH_ERROR); ssh_buffer_reinit(buffer); /* with additional format */ rc = ssh_buffer_pack(buffer, "bb", b); /* check that we detect the missing parameter */ assert_int_equal(rc, SSH_ERROR); /* unpack with missing format */ ssh_buffer_reinit(buffer); rc = ssh_buffer_pack(buffer, "bb", 42, 43); assert_int_equal(rc, SSH_OK); rc = ssh_buffer_unpack(buffer, "b", &b, &b); assert_int_equal(rc, SSH_ERROR); /* not doing the test with additional format as * it could crash the process */ } int torture_run_tests(void) { int rc; struct CMUnitTest tests[] = { cmocka_unit_test_setup_teardown(torture_growing_buffer, setup, teardown), cmocka_unit_test_setup_teardown(torture_growing_buffer_shifting, setup, teardown), cmocka_unit_test_setup_teardown(torture_buffer_prepend, setup, teardown), cmocka_unit_test(torture_ssh_buffer_get_ssh_string), cmocka_unit_test_setup_teardown(torture_ssh_buffer_add_format, setup, teardown), cmocka_unit_test_setup_teardown(torture_ssh_buffer_get_format, setup, teardown), cmocka_unit_test_setup_teardown(torture_ssh_buffer_get_format_error, setup, teardown), cmocka_unit_test_setup_teardown(torture_buffer_pack_badformat, setup, teardown) }; ssh_init(); torture_filter_tests(tests); rc = cmocka_run_group_tests(tests, NULL, NULL); ssh_finalize(); return rc; }