1 /* SPDX-License-Identifier: BSD-3-Clause 2 * Copyright (C) 2019 Intel Corporation. 3 * All rights reserved. 4 */ 5 6 #include "spdk/stdinc.h" 7 #include "spdk/event.h" 8 #include "spdk/util.h" 9 #include "spdk/string.h" 10 #include "spdk/likely.h" 11 #include "spdk/json.h" 12 #include "spdk/endian.h" 13 #include "spdk/bdev.h" 14 #include "spdk/notify.h" 15 #include "spdk/scsi.h" 16 #include "spdk_internal/mock.h" 17 #include "spdk/scsi_spec.h" 18 #include "iscsi/conn.h" 19 #include "iscsi/iscsi.c" 20 #include "scsi/scsi_internal.h" 21 #include "spdk/sock.h" 22 23 #define GET_PDU_LOOP_COUNT 16 24 #define DEFAULT_RUNTIME 30 /* seconds */ 25 #define MAX_RUNTIME_S 86400 /* 24 hours */ 26 27 /* Global run state */ 28 uint64_t g_runtime_ticks; 29 int g_runtime; 30 int g_num_active_threads; 31 bool g_run = true; 32 bool g_is_valid_opcode = true; 33 34 SPDK_LOG_REGISTER_COMPONENT(iscsi) 35 36 /* Global resources */ 37 TAILQ_HEAD(, spdk_iscsi_pdu) g_get_pdu_list; 38 TAILQ_HEAD(, fuzz_iscsi_dev_ctx) g_dev_list = TAILQ_HEAD_INITIALIZER(g_dev_list); 39 struct spdk_poller *g_app_completion_poller; 40 void *g_valid_buffer; 41 unsigned int g_random_seed; 42 char *g_tgt_ip = "127.0.0.1"; 43 char *g_tgt_port = "3260"; 44 /* TBD: Discovery login to get target information. We use fixed IQN for target for now. */ 45 char *g_tgt_name = "iqn.2016-06.io.spdk:disk1"; 46 char *g_init_name = "iqn.2016-06.io.spdk:fuzzinit"; 47 48 struct fuzz_iscsi_iov_ctx { 49 struct iovec iov_req; 50 struct iovec iov_data; 51 struct iovec iov_resp; 52 }; 53 54 struct fuzz_iscsi_io_ctx { 55 struct fuzz_iscsi_iov_ctx iov_ctx; 56 union { 57 struct iscsi_bhs *bhs; 58 struct iscsi_bhs_nop_out *nop_out_req; 59 struct iscsi_bhs_scsi_req *scsi_req; 60 struct iscsi_bhs_task_req *task_req; 61 struct iscsi_bhs_login_req *login_req; 62 struct iscsi_bhs_text_req *text_req; 63 struct iscsi_bhs_data_out *data_out_req; 64 struct iscsi_bhs_logout_req *logout_req; 65 struct iscsi_bhs_snack_req *snack_req; 66 } req; 67 }; 68 69 struct fuzz_iscsi_dev_ctx { 70 struct spdk_iscsi_sess sess; 71 struct spdk_iscsi_conn *conn; 72 struct fuzz_iscsi_io_ctx io_ctx; 73 74 struct spdk_thread *thread; 75 struct spdk_poller *poller; 76 unsigned int random_seed, current_cmd_sn; 77 uint64_t num_sent_pdus; 78 uint64_t num_valid_pdus; 79 80 TAILQ_ENTRY(fuzz_iscsi_dev_ctx) link; 81 }; 82 83 static void 84 fuzz_fill_random_bytes(char *character_repr, size_t len, unsigned int *rand_seed) 85 { 86 size_t i; 87 88 for (i = 0; i < len; i++) { 89 character_repr[i] = rand_r(rand_seed) % UINT8_MAX; 90 } 91 } 92 93 static char * 94 fuzz_get_value_base_64_buffer(void *item, size_t len) 95 { 96 char *value_string; 97 size_t total_size; 98 int rc; 99 100 /* Null pointer */ 101 total_size = spdk_base64_get_encoded_strlen(len) + 1; 102 103 value_string = calloc(1, total_size); 104 if (value_string == NULL) { 105 return NULL; 106 } 107 108 rc = spdk_base64_encode(value_string, item, len); 109 if (rc < 0) { 110 free(value_string); 111 return NULL; 112 } 113 114 return value_string; 115 } 116 117 int 118 iscsi_chap_get_authinfo(struct iscsi_chap_auth *auth, const char *authuser, 119 int ag_tag) 120 { 121 return 0; 122 } 123 124 void 125 shutdown_iscsi_conns_done(void) 126 { 127 return; 128 } 129 130 void 131 iscsi_put_pdu(struct spdk_iscsi_pdu *pdu) 132 { 133 if (!pdu) { 134 return; 135 } 136 137 pdu->ref--; 138 if (pdu->ref < 0) { 139 pdu->ref = 0; 140 } 141 142 if (pdu->ref == 0) { 143 if (pdu->data) { 144 free(pdu->data); 145 } 146 free(pdu); 147 } 148 } 149 150 struct spdk_iscsi_pdu * 151 iscsi_get_pdu(struct spdk_iscsi_conn *conn) 152 { 153 struct spdk_iscsi_pdu *pdu; 154 155 pdu = calloc(1, sizeof(*pdu)); 156 if (!pdu) { 157 return NULL; 158 } 159 160 pdu->ref = 1; 161 pdu->conn = conn; 162 163 return pdu; 164 } 165 166 static void 167 iscsi_task_free(struct spdk_scsi_task *scsi_task) 168 { 169 struct spdk_iscsi_task *task = iscsi_task_from_scsi_task(scsi_task); 170 171 assert(task->parent == NULL); 172 173 iscsi_task_disassociate_pdu(task); 174 assert(task->conn->pending_task_cnt > 0); 175 task->conn->pending_task_cnt--; 176 free(task); 177 } 178 179 struct spdk_iscsi_task * 180 iscsi_task_get(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *parent, 181 spdk_scsi_task_cpl cpl_fn) 182 { 183 struct spdk_iscsi_task *task; 184 185 /* iSCSI subtask is not necessary for now. */ 186 assert(parent == NULL); 187 188 task = calloc(1, sizeof(*task)); 189 if (!task) { 190 printf("Unable to get task\n"); 191 abort(); 192 } 193 194 task->conn = conn; 195 assert(conn->pending_task_cnt < UINT32_MAX); 196 conn->pending_task_cnt++; 197 spdk_scsi_task_construct(&task->scsi, cpl_fn, iscsi_task_free); 198 199 return task; 200 } 201 202 static void 203 cleanup(void) 204 { 205 struct fuzz_iscsi_dev_ctx *dev_ctx, *tmp; 206 207 TAILQ_FOREACH_SAFE(dev_ctx, &g_dev_list, link, tmp) { 208 printf("device %p stats: Sent %" PRIu64 " valid opcode PDUs, %" PRIu64 " invalid opcode PDUs.\n", 209 dev_ctx, dev_ctx->num_valid_pdus, 210 dev_ctx->num_sent_pdus - dev_ctx->num_valid_pdus); 211 free(dev_ctx); 212 } 213 214 spdk_free(g_valid_buffer); 215 } 216 217 /* data dumping functions begin */ 218 static int 219 dump_iscsi_cmd(void *ctx, const void *data, size_t size) 220 { 221 fprintf(stderr, "%s\n", (const char *)data); 222 return 0; 223 } 224 225 static void 226 print_scsi_io_data(struct spdk_json_write_ctx *w, struct fuzz_iscsi_io_ctx *io_ctx) 227 { 228 char *data_segment_len; 229 230 data_segment_len = fuzz_get_value_base_64_buffer((void *)io_ctx->req.bhs->data_segment_len, 231 sizeof(io_ctx->req.bhs->data_segment_len)); 232 233 spdk_json_write_named_uint32(w, "opcode", io_ctx->req.bhs->opcode); 234 spdk_json_write_named_uint32(w, "immediate", io_ctx->req.bhs->immediate); 235 spdk_json_write_named_uint32(w, "reserved", io_ctx->req.bhs->reserved); 236 spdk_json_write_named_uint32(w, "total_ahs_len", io_ctx->req.bhs->total_ahs_len); 237 spdk_json_write_named_string(w, "data_segment_len", data_segment_len); 238 spdk_json_write_named_uint32(w, "itt", io_ctx->req.bhs->itt); 239 spdk_json_write_named_uint32(w, "exp_stat_sn", io_ctx->req.bhs->exp_stat_sn); 240 241 free(data_segment_len); 242 } 243 244 static void 245 print_req_obj(struct fuzz_iscsi_dev_ctx *dev_ctx, struct fuzz_iscsi_io_ctx *io_ctx) 246 { 247 struct spdk_json_write_ctx *w; 248 249 w = spdk_json_write_begin(dump_iscsi_cmd, NULL, SPDK_JSON_WRITE_FLAG_FORMATTED); 250 spdk_json_write_named_object_begin(w, "bhs"); 251 print_scsi_io_data(w, io_ctx); 252 spdk_json_write_object_end(w); 253 spdk_json_write_end(w); 254 } 255 256 /* data dumping functions end */ 257 258 /* dev initialization begin */ 259 static int 260 fuzz_iscsi_dev_init(void) 261 { 262 struct fuzz_iscsi_dev_ctx *dev_ctx; 263 int rc = 0; 264 265 dev_ctx = calloc(1, sizeof(*dev_ctx)); 266 if (dev_ctx == NULL) { 267 return -ENOMEM; 268 } 269 270 dev_ctx->thread = spdk_get_thread(); 271 if (dev_ctx->thread == NULL) { 272 fprintf(stderr, "Unable to get a thread for a fuzz device.\n"); 273 rc = -EINVAL; 274 goto error_out; 275 } 276 277 dev_ctx->current_cmd_sn = 0; 278 279 TAILQ_INSERT_TAIL(&g_dev_list, dev_ctx, link); 280 return 0; 281 282 error_out: 283 free(dev_ctx); 284 return rc; 285 } 286 /* dev initialization end */ 287 288 /* build requests begin */ 289 static void 290 prep_iscsi_pdu_bhs_opcode_cmd(struct fuzz_iscsi_dev_ctx *dev_ctx, struct fuzz_iscsi_io_ctx *io_ctx) 291 { 292 io_ctx->iov_ctx.iov_req.iov_len = sizeof(struct iscsi_bhs); 293 fuzz_fill_random_bytes((char *)io_ctx->req.bhs, sizeof(struct iscsi_bhs), 294 &dev_ctx->random_seed); 295 } 296 /* build requests end */ 297 298 static int 299 iscsi_pdu_hdr_op_login_rsp(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu) 300 { 301 return 0; 302 } 303 304 static int 305 iscsi_fuzz_pdu_hdr_handle(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu) 306 { 307 int opcode; 308 int rc = 0; 309 310 opcode = pdu->bhs.opcode; 311 if (opcode == ISCSI_OP_LOGIN_RSP) { 312 return iscsi_pdu_hdr_op_login_rsp(conn, pdu); 313 } 314 315 switch (opcode) { 316 case ISCSI_OP_LOGOUT_RSP: 317 fprintf(stderr, "Received logout hdr_handle response opcode(0x26) from Target.\n"); 318 conn->is_logged_out = true; 319 break; 320 case ISCSI_OP_NOPIN: 321 case ISCSI_OP_SCSI_RSP: 322 case ISCSI_OP_TASK_RSP: 323 case ISCSI_OP_TEXT_RSP: 324 case ISCSI_OP_SCSI_DATAIN: 325 case ISCSI_OP_R2T: 326 case ISCSI_OP_ASYNC: 327 case ISCSI_OP_VENDOR_3C: 328 case ISCSI_OP_VENDOR_3D: 329 case ISCSI_OP_VENDOR_3E: 330 fprintf(stderr, "Received hdr_handle response opcode from Target is 0x%x.\n", pdu->bhs.opcode); 331 break; 332 case ISCSI_OP_REJECT: 333 fprintf(stderr, "Received rejected hdr_handle response opcode(0x3f) from Target.\n"); 334 break; 335 default: 336 rc = -1; 337 break; 338 } 339 340 return rc; 341 } 342 343 static int 344 iscsi_pdu_payload_op_login_rsp(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu) 345 { 346 struct iscsi_bhs_login_rsp *rsph; 347 348 rsph = (struct iscsi_bhs_login_rsp *)&pdu->bhs; 349 if (rsph == NULL) { 350 return -1; 351 } 352 353 assert(rsph->tsih != 0); 354 assert(rsph->status_class == 0); 355 assert(ISCSI_BHS_LOGIN_GET_TBIT(rsph->flags)); 356 assert(!(rsph->flags & ISCSI_LOGIN_CONTINUE)); 357 assert((rsph->flags & ISCSI_LOGIN_NEXT_STAGE_MASK) == ISCSI_LOGIN_NEXT_STAGE_3); 358 359 /* We got the Login Final Response and move to Full-Feature Phase. */ 360 conn->full_feature = 1; 361 return 0; 362 } 363 364 static int 365 iscsi_fuzz_pdu_payload_handle(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu) 366 { 367 int opcode; 368 int rc = 0; 369 370 opcode = pdu->bhs.opcode; 371 fprintf(stderr, "Received payload_handle response opcode from Target is 0x%x.\n", opcode); 372 373 switch (opcode) { 374 case ISCSI_OP_LOGIN_RSP: 375 rc = iscsi_pdu_payload_op_login_rsp(conn, pdu); 376 break; 377 case ISCSI_OP_NOPIN: 378 case ISCSI_OP_SCSI_RSP: 379 case ISCSI_OP_TASK_RSP: 380 case ISCSI_OP_TEXT_RSP: 381 case ISCSI_OP_SCSI_DATAIN: 382 case ISCSI_OP_R2T: 383 case ISCSI_OP_ASYNC: 384 case ISCSI_OP_VENDOR_3C: 385 case ISCSI_OP_VENDOR_3D: 386 case ISCSI_OP_VENDOR_3E: 387 case ISCSI_OP_REJECT: 388 break; 389 default: 390 rc = -1; 391 break; 392 } 393 394 return rc; 395 } 396 397 static int 398 iscsi_fuzz_read_pdu(struct spdk_iscsi_conn *conn) 399 { 400 enum iscsi_pdu_recv_state prev_state; 401 struct spdk_iscsi_pdu *pdu; 402 uint32_t data_len; 403 int rc; 404 405 do { 406 prev_state = conn->pdu_recv_state; 407 pdu = conn->pdu_in_progress; 408 409 switch (conn->pdu_recv_state) { 410 case ISCSI_PDU_RECV_STATE_AWAIT_PDU_READY: 411 assert(conn->pdu_in_progress == NULL); 412 413 conn->pdu_in_progress = iscsi_get_pdu(conn); 414 if (conn->pdu_in_progress == NULL) { 415 return SPDK_ISCSI_CONNECTION_FATAL; 416 } 417 TAILQ_INSERT_TAIL(&g_get_pdu_list, conn->pdu_in_progress, tailq); 418 conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_AWAIT_PDU_HDR; 419 break; 420 case ISCSI_PDU_RECV_STATE_AWAIT_PDU_HDR: 421 if (pdu->bhs_valid_bytes < ISCSI_BHS_LEN) { 422 rc = iscsi_conn_read_data(conn, 423 ISCSI_BHS_LEN - pdu->bhs_valid_bytes, 424 (uint8_t *)&pdu->bhs + pdu->bhs_valid_bytes); 425 if (rc < 0) { 426 conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR; 427 break; 428 } 429 pdu->bhs_valid_bytes += rc; 430 if (pdu->bhs_valid_bytes < ISCSI_BHS_LEN) { 431 return 0; 432 } 433 } 434 435 pdu->data_segment_len = ISCSI_ALIGN(DGET24(pdu->bhs.data_segment_len)); 436 437 rc = iscsi_fuzz_pdu_hdr_handle(conn, pdu); 438 if (rc < 0) { 439 printf("Critical error is detected. Close the connection\n"); 440 conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR; 441 break; 442 } 443 444 if (conn->is_logged_out) { 445 printf("pdu received after logout\n"); 446 conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR; 447 break; 448 } 449 450 conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_AWAIT_PDU_PAYLOAD; 451 break; 452 case ISCSI_PDU_RECV_STATE_AWAIT_PDU_PAYLOAD: 453 data_len = pdu->data_segment_len; 454 if (data_len != 0 && pdu->data == NULL) { 455 pdu->data = calloc(1, data_len); 456 if (pdu->data == NULL) { 457 return 0; 458 } 459 } 460 461 /* copy the actual data into local buffer */ 462 if (pdu->data_valid_bytes < data_len) { 463 rc = iscsi_conn_read_data_segment(conn, pdu, 464 pdu->data_valid_bytes, 465 data_len - pdu->data_valid_bytes); 466 if (rc < 0) { 467 conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR; 468 break; 469 } 470 pdu->data_valid_bytes += rc; 471 if (pdu->data_valid_bytes < data_len) { 472 return 0; 473 } 474 } 475 476 /* All data for this PDU has now been read from the socket. */ 477 spdk_trace_record(TRACE_ISCSI_READ_PDU, conn->id, pdu->data_valid_bytes, 478 (uintptr_t)pdu, pdu->bhs.opcode); 479 480 if (!pdu->is_rejected) { 481 rc = iscsi_fuzz_pdu_payload_handle(conn, pdu); 482 } else { 483 rc = 0; 484 } 485 if (rc == 0) { 486 spdk_trace_record(TRACE_ISCSI_TASK_EXECUTED, 0, 0, (uintptr_t)pdu); 487 conn->pdu_in_progress = NULL; 488 conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_AWAIT_PDU_READY; 489 return 1; 490 } else { 491 conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR; 492 } 493 break; 494 case ISCSI_PDU_RECV_STATE_ERROR: 495 return SPDK_ISCSI_CONNECTION_FATAL; 496 default: 497 assert(false); 498 printf("code should not come here\n"); 499 break; 500 } 501 } while (prev_state != conn->pdu_recv_state); 502 503 return 0; 504 } 505 506 #define GET_PDU_LOOP_COUNT 16 507 508 static int 509 fuzz_iscsi_handle_incoming_pdus(struct spdk_iscsi_conn *conn) 510 { 511 int i, rc; 512 513 /* Read new PDUs from network */ 514 for (i = 0; i < GET_PDU_LOOP_COUNT; i++) { 515 rc = iscsi_fuzz_read_pdu(conn); 516 if (rc == 0) { 517 break; 518 } else if (rc < 0) { 519 return rc; 520 } 521 } 522 523 return i; 524 } 525 526 static void 527 fuzz_iscsi_send_login_request(struct fuzz_iscsi_dev_ctx *dev_ctx, uint8_t session_type) 528 { 529 struct fuzz_iscsi_io_ctx *io_ctx = NULL; 530 struct spdk_iscsi_pdu *req_pdu; 531 struct iscsi_bhs_login_req *login_req; 532 struct spdk_iscsi_conn *conn = dev_ctx->conn; 533 534 req_pdu = iscsi_get_pdu(conn); 535 req_pdu->writev_offset = 0; 536 req_pdu->hdigest_valid_bytes = 0; 537 req_pdu->ahs_valid_bytes = 0; 538 req_pdu->data_buf_len = 8192; 539 req_pdu->data = calloc(1, 8192); 540 assert(req_pdu->data != NULL); 541 req_pdu->data_segment_len = 0; 542 543 login_req = (struct iscsi_bhs_login_req *)&req_pdu->bhs; 544 io_ctx = &dev_ctx->io_ctx; 545 io_ctx->req.login_req = login_req; 546 io_ctx->req.login_req->version_min = 0; 547 /* a new session */ 548 io_ctx->req.login_req->tsih = 0; 549 550 req_pdu->bhs.opcode = ISCSI_OP_LOGIN; 551 req_pdu->bhs.immediate = 1; 552 req_pdu->bhs.reserved = 0; 553 req_pdu->bhs_valid_bytes = ISCSI_BHS_LEN; 554 req_pdu->bhs.total_ahs_len = 0; 555 556 /* An initiator that chooses to operate without iSCSI security and with 557 * all the operational parameters taking the default values issues the 558 * Login with the T bit set to 1, the CSG set to 559 * LoginOperationalNegotiation, and the NSG set to FullFeaturePhase. 560 * 561 * Byte / 0 | 1 | 2 | 3 | 562 * |0 1 2 3 4 5 6 7|0 1 2 3 4 5 6 7|0 1 2 3 4 5 6 7|0 1 2 3 4 5 6 7| 563 * +---------------+---------------+---------------+---------------+ 564 * 0|.|1| 0x03 |T|C|.|.|CSG|NSG| Version-max | Version-min | 565 */ 566 req_pdu->bhs.flags = ISCSI_LOGIN_TRANSIT | (ISCSI_OPERATIONAL_NEGOTIATION_PHASE << 2) | 567 ISCSI_FULL_FEATURE_PHASE; 568 569 req_pdu->data_segment_len = iscsi_append_text("InitiatorName", g_init_name, 570 req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len); 571 req_pdu->data_segment_len = iscsi_append_text("HeaderDigest", "None", 572 req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len); 573 req_pdu->data_segment_len = iscsi_append_text("DataDigest", "None", 574 req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len); 575 req_pdu->data_segment_len = iscsi_append_text("DefaultTime2Wait", "2", 576 req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len); 577 req_pdu->data_segment_len = iscsi_append_text("DefaultTime2Retain", "0", 578 req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len); 579 req_pdu->data_segment_len = iscsi_append_text("IFMarker", "No", 580 req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len); 581 req_pdu->data_segment_len = iscsi_append_text("OFMarker", "No", 582 req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len); 583 req_pdu->data_segment_len = iscsi_append_text("ErrorRecoveryLevel", "0", 584 req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len); 585 586 if (session_type == SESSION_TYPE_DISCOVERY) { 587 /* Discovery PDU */ 588 conn->sess->session_type = SESSION_TYPE_DISCOVERY; 589 req_pdu->data_segment_len = iscsi_append_text("SessionType", "Discovery", 590 req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len); 591 req_pdu->data_segment_len = iscsi_append_text("MaxRecvDataSegmentLength", "32768", 592 req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len); 593 } else { 594 /* Login PDU */ 595 conn->sess->session_type = SESSION_TYPE_NORMAL; 596 req_pdu->data_segment_len = iscsi_append_text("SessionType", "Normal", 597 req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len); 598 req_pdu->data_segment_len = iscsi_append_text("TargetName", g_tgt_name, 599 req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len); 600 req_pdu->data_segment_len = iscsi_append_text("InitialR2T", "No", 601 req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len); 602 req_pdu->data_segment_len = iscsi_append_text("ImmediateData", "Yes", 603 req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len); 604 req_pdu->data_segment_len = iscsi_append_text("MaxBurstLength", "16776192", 605 req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len); 606 req_pdu->data_segment_len = iscsi_append_text("FirstBurstLength", "262144", 607 req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len); 608 req_pdu->data_segment_len = iscsi_append_text("MaxOutstandingR2T", "1", 609 req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len); 610 req_pdu->data_segment_len = iscsi_append_text("MaxConnections", "1", 611 req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len); 612 req_pdu->data_segment_len = iscsi_append_text("DataPDUInOrder", "Yes", 613 req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len); 614 req_pdu->data_segment_len = iscsi_append_text("DataSequenceInOrder", "Yes", 615 req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len); 616 req_pdu->data_segment_len = iscsi_append_text("MaxRecvDataSegmentLength", "262144", 617 req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len); 618 } 619 620 DSET24(req_pdu->bhs.data_segment_len, req_pdu->data_segment_len); 621 iscsi_conn_write_pdu(conn, req_pdu, iscsi_conn_pdu_generic_complete, NULL); 622 } 623 624 static void 625 fuzz_iscsi_send_logout_request(struct fuzz_iscsi_dev_ctx *dev_ctx) 626 { 627 struct fuzz_iscsi_io_ctx *io_ctx = NULL; 628 struct spdk_iscsi_pdu *req_pdu; 629 struct iscsi_bhs_logout_req *logout_req; 630 struct spdk_iscsi_conn *conn = dev_ctx->conn; 631 632 conn->is_logged_out = true; 633 634 req_pdu = iscsi_get_pdu(conn); 635 req_pdu->writev_offset = 0; 636 req_pdu->hdigest_valid_bytes = 0; 637 req_pdu->ahs_valid_bytes = 0; 638 req_pdu->data_buf_len = 0; 639 640 logout_req = (struct iscsi_bhs_logout_req *)&req_pdu->bhs; 641 io_ctx = &dev_ctx->io_ctx; 642 io_ctx->req.logout_req = logout_req; 643 644 req_pdu->bhs.opcode = ISCSI_OP_LOGOUT; 645 req_pdu->bhs.immediate = 1; 646 req_pdu->bhs.reserved = 0; 647 req_pdu->bhs_valid_bytes = ISCSI_BHS_LEN; 648 req_pdu->bhs.total_ahs_len = 0; 649 req_pdu->bhs.flags = 0; 650 651 DSET24(req_pdu->bhs.data_segment_len, 0); 652 iscsi_conn_write_pdu(conn, req_pdu, iscsi_conn_pdu_generic_complete, conn); 653 } 654 655 static void 656 iscsi_fuzz_conn_reset(struct spdk_iscsi_conn *conn, struct spdk_iscsi_sess *sess) 657 { 658 conn->sess = sess; 659 conn->data_in_cnt = 0; 660 conn->params = NULL; 661 conn->header_digest = true; 662 conn->data_digest = false; 663 conn->header_digest = 0; 664 conn->MaxRecvDataSegmentLength = 8192; 665 conn->full_feature = 0; 666 conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_AWAIT_PDU_READY; 667 conn->pdu_in_progress = NULL; 668 conn->is_logged_out = 0; 669 } 670 671 static void 672 iscsi_fuzz_sock_connect(struct spdk_iscsi_conn *conn) 673 { 674 const char *host = g_tgt_ip; 675 const char *port = g_tgt_port; 676 char saddr[INET6_ADDRSTRLEN], caddr[INET6_ADDRSTRLEN]; 677 uint16_t cport, sport; 678 int rc = 0; 679 680 conn->sock = spdk_sock_connect(host, spdk_strtol(port, 10), NULL); 681 if (conn->sock == NULL) { 682 fprintf(stderr, "connect error(%d): %s\n", errno, spdk_strerror(errno)); 683 spdk_sock_close(&conn->sock); 684 return; 685 } 686 fprintf(stderr, "\nConnecting to the server on %s:%s\n", host, port); 687 688 rc = spdk_sock_getaddr(conn->sock, saddr, sizeof(saddr), &sport, caddr, sizeof(caddr), &cport); 689 if (rc < 0) { 690 fprintf(stderr, "Cannot get connection addresses\n"); 691 spdk_sock_close(&conn->sock); 692 return; 693 } 694 695 fprintf(stderr, "Connection accepted from (%s, %hu) to (%s, %hu)\n", caddr, cport, saddr, sport); 696 697 } 698 699 static void 700 check_successful_op(struct fuzz_iscsi_dev_ctx *dev_ctx, struct fuzz_iscsi_io_ctx *io_ctx) 701 { 702 if (g_is_valid_opcode) { 703 fprintf(stderr, "Sent a valid opcode PDU.\n"); 704 dev_ctx->num_valid_pdus++; 705 } else { 706 fprintf(stderr, "Sent an invalid opcode PDU.\n"); 707 } 708 } 709 710 /* submit requests begin */ 711 static void 712 dev_submit_requests(struct fuzz_iscsi_dev_ctx *dev_ctx) 713 { 714 struct fuzz_iscsi_io_ctx *io_ctx = NULL; 715 uint8_t opcode; 716 struct spdk_iscsi_pdu *req_pdu; 717 struct iscsi_bhs *bhs; 718 struct iscsi_bhs_nop_out *nop_out_req; 719 struct iscsi_bhs_scsi_req *scsi_req; 720 struct iscsi_bhs_task_req *task_req; 721 struct iscsi_bhs_text_req *text_req; 722 struct iscsi_bhs_data_out *data_out_req; 723 struct iscsi_bhs_snack_req *snack_req; 724 unsigned int rand_seed; 725 bool is_p99; 726 727 g_is_valid_opcode = true; 728 729 /* Random PDU */ 730 opcode = rand() % 0x3f; 731 fprintf(stderr, "Random request bhs.opcode of Initiator is 0x%x.\n", opcode); 732 733 if ((opcode == ISCSI_OP_LOGIN) || (opcode == ISCSI_OP_LOGOUT)) { 734 /* only need send next */ 735 fprintf(stderr, "LOGIN and LOGOUT opcodes are ignored here.\n"); 736 return; 737 } 738 739 req_pdu = iscsi_get_pdu(dev_ctx->conn); 740 req_pdu->writev_offset = 0; 741 req_pdu->hdigest_valid_bytes = 0; 742 req_pdu->ahs_valid_bytes = 0; 743 req_pdu->data_buf_len = 0; 744 745 dev_ctx->conn->sess->session_type = SESSION_TYPE_NORMAL; 746 747 io_ctx = &dev_ctx->io_ctx; 748 749 switch (opcode) { 750 case ISCSI_OP_NOPOUT: 751 nop_out_req = (struct iscsi_bhs_nop_out *)&req_pdu->bhs; 752 io_ctx->req.nop_out_req = nop_out_req; 753 break; 754 case ISCSI_OP_SCSI: 755 scsi_req = (struct iscsi_bhs_scsi_req *)&req_pdu->bhs; 756 io_ctx->req.scsi_req = scsi_req; 757 break; 758 case ISCSI_OP_TASK: 759 task_req = (struct iscsi_bhs_task_req *)&req_pdu->bhs; 760 io_ctx->req.task_req = task_req; 761 break; 762 case ISCSI_OP_TEXT: 763 text_req = (struct iscsi_bhs_text_req *)&req_pdu->bhs; 764 io_ctx->req.text_req = text_req; 765 break; 766 case ISCSI_OP_SCSI_DATAOUT: 767 data_out_req = (struct iscsi_bhs_data_out *)&req_pdu->bhs; 768 io_ctx->req.data_out_req = data_out_req; 769 break; 770 case ISCSI_OP_SNACK: 771 snack_req = (struct iscsi_bhs_snack_req *)&req_pdu->bhs; 772 io_ctx->req.snack_req = snack_req; 773 break; 774 default: 775 bhs = (struct iscsi_bhs *)&req_pdu->bhs; 776 io_ctx->req.bhs = bhs; 777 g_is_valid_opcode = false; 778 break; 779 } 780 781 prep_iscsi_pdu_bhs_opcode_cmd(dev_ctx, io_ctx); 782 io_ctx->req.bhs->opcode = opcode; 783 req_pdu->bhs.opcode = opcode; 784 req_pdu->bhs.immediate = 1; 785 req_pdu->bhs.reserved = 0; 786 req_pdu->bhs_valid_bytes = ISCSI_BHS_LEN; 787 req_pdu->bhs.total_ahs_len = 0; 788 req_pdu->bhs.stat_sn = 0; 789 DSET24(req_pdu->bhs.data_segment_len, 0); 790 791 if (opcode <= ISCSI_OP_TEXT) { 792 rand_seed = time(NULL); 793 is_p99 = rand_r(&rand_seed) % 100 == 0 ? true : false; 794 if (!is_p99) { /* Remaining 1% */ 795 switch (opcode) { 796 case ISCSI_OP_NOPOUT: 797 if (req_pdu->bhs.immediate) { 798 io_ctx->req.nop_out_req->cmd_sn = dev_ctx->current_cmd_sn; 799 } else { 800 io_ctx->req.nop_out_req->cmd_sn = dev_ctx->current_cmd_sn++; 801 } 802 break; 803 case ISCSI_OP_SCSI: 804 if (req_pdu->bhs.immediate) { 805 io_ctx->req.scsi_req->cmd_sn = dev_ctx->current_cmd_sn; 806 } else { 807 io_ctx->req.scsi_req->cmd_sn = dev_ctx->current_cmd_sn++; 808 } 809 break; 810 case ISCSI_OP_TASK: 811 if (req_pdu->bhs.immediate) { 812 io_ctx->req.task_req->cmd_sn = dev_ctx->current_cmd_sn; 813 } else { 814 io_ctx->req.task_req->cmd_sn = dev_ctx->current_cmd_sn++; 815 } 816 break; 817 case ISCSI_OP_TEXT: 818 if (req_pdu->bhs.immediate) { 819 io_ctx->req.text_req->cmd_sn = dev_ctx->current_cmd_sn; 820 } else { 821 io_ctx->req.text_req->cmd_sn = dev_ctx->current_cmd_sn++; 822 } 823 break; 824 default: 825 break; 826 } 827 } 828 } 829 830 if (opcode == ISCSI_OP_SCSI) { 831 /* avoid ((R_bit != 0) && (W_bit != 0)) is true */ 832 io_ctx->req.scsi_req->read_bit = 0; 833 io_ctx->req.scsi_req->write_bit = 0; 834 } 835 836 if (opcode == ISCSI_OP_TEXT) { 837 /* avoid: (F_bit && C_bit) is true */ 838 io_ctx->req.text_req->flags = 0; 839 /* avoid: correct itt is not equal to the current itt */ 840 io_ctx->req.text_req->itt = 0; 841 } 842 843 fprintf(stderr, "Dumping this request bhs contents now.\n"); 844 print_req_obj(dev_ctx, io_ctx); 845 846 check_successful_op(dev_ctx, io_ctx); 847 dev_ctx->num_sent_pdus++; 848 849 iscsi_conn_write_pdu(dev_ctx->conn, req_pdu, 850 iscsi_conn_pdu_generic_complete, NULL); 851 } 852 /* submit requests end */ 853 854 static int 855 poll_dev(void *ctx) 856 { 857 struct fuzz_iscsi_dev_ctx *dev_ctx = ctx; 858 struct spdk_iscsi_conn *conn = dev_ctx->conn; 859 uint64_t current_ticks; 860 struct spdk_iscsi_pdu *pdu, *tmp; 861 862 current_ticks = spdk_get_ticks(); 863 if (current_ticks > g_runtime_ticks) { 864 g_run = false; 865 } 866 867 if (!g_run) { 868 /* Logout PDU */ 869 fuzz_iscsi_send_logout_request(dev_ctx); 870 fuzz_iscsi_handle_incoming_pdus(conn); 871 872 TAILQ_FOREACH_SAFE(pdu, &g_get_pdu_list, tailq, tmp) { 873 TAILQ_REMOVE(&g_get_pdu_list, pdu, tailq); 874 iscsi_put_pdu(pdu); 875 } 876 877 spdk_sock_close(&conn->sock); 878 879 TAILQ_FOREACH_SAFE(pdu, &conn->write_pdu_list, tailq, tmp) { 880 TAILQ_REMOVE(&conn->write_pdu_list, pdu, tailq); 881 iscsi_put_pdu(pdu); 882 } 883 884 free(conn); 885 886 spdk_poller_unregister(&dev_ctx->poller); 887 __sync_sub_and_fetch(&g_num_active_threads, 1); 888 889 return -1; 890 } 891 892 if (conn->is_logged_out) { 893 spdk_sock_close(&conn->sock); 894 iscsi_fuzz_conn_reset(conn, &dev_ctx->sess); 895 iscsi_fuzz_sock_connect(conn); 896 usleep(1000); 897 898 /* Login PDU */ 899 fuzz_iscsi_send_login_request(dev_ctx, SESSION_TYPE_NORMAL); 900 } else if (conn->full_feature == 1) { 901 dev_submit_requests(dev_ctx); 902 } 903 904 spdk_sock_flush(conn->sock); 905 906 fuzz_iscsi_handle_incoming_pdus(conn); 907 908 return 0; 909 } 910 911 static void 912 start_io(void *ctx) 913 { 914 struct fuzz_iscsi_dev_ctx *dev_ctx = ctx; 915 916 dev_ctx->sess.ExpCmdSN = 0; 917 dev_ctx->sess.MaxCmdSN = 64; 918 dev_ctx->sess.MaxBurstLength = SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH; 919 dev_ctx->sess.MaxOutstandingR2T = 1; 920 dev_ctx->sess.tag = 1; 921 dev_ctx->sess.tsih = 256; 922 923 dev_ctx->conn = calloc(1, sizeof(*dev_ctx->conn)); 924 assert(dev_ctx->conn != NULL); 925 TAILQ_INIT(&dev_ctx->conn->write_pdu_list); 926 927 iscsi_fuzz_conn_reset(dev_ctx->conn, &dev_ctx->sess); 928 iscsi_fuzz_sock_connect(dev_ctx->conn); 929 usleep(1000); 930 931 /* Login PDU */ 932 fuzz_iscsi_send_login_request(dev_ctx, SESSION_TYPE_NORMAL); 933 934 if (g_random_seed) { 935 dev_ctx->random_seed = g_random_seed; 936 } else { 937 dev_ctx->random_seed = spdk_get_ticks(); 938 } 939 940 dev_ctx->poller = SPDK_POLLER_REGISTER(poll_dev, dev_ctx, 0); 941 if (dev_ctx->poller == NULL) { 942 return; 943 } 944 } 945 946 static int 947 check_app_completion(void *ctx) 948 { 949 if (g_num_active_threads == 0) { 950 spdk_poller_unregister(&g_app_completion_poller); 951 printf("Fuzzing completed. Shutting down the fuzz application.\n\n"); 952 cleanup(); 953 spdk_app_stop(0); 954 } 955 return 0; 956 } 957 958 static void 959 begin_iscsi_fuzz(void *ctx) 960 { 961 struct fuzz_iscsi_dev_ctx *dev_ctx; 962 int rc; 963 964 g_runtime_ticks = spdk_get_ticks() + g_runtime * spdk_get_ticks_hz(); 965 966 g_valid_buffer = spdk_malloc(0x1000, 0x200, NULL, SPDK_ENV_LCORE_ID_ANY, SPDK_MALLOC_SHARE); 967 if (g_valid_buffer == NULL) { 968 fprintf(stderr, "Failed to allocate a valid buffer for random PDUs\n"); 969 goto out; 970 } 971 972 rc = fuzz_iscsi_dev_init(); 973 if (rc) { 974 fprintf(stderr, "fuzz_iscsi_dev_init() failed.\n"); 975 goto out; 976 } 977 978 TAILQ_FOREACH(dev_ctx, &g_dev_list, link) { 979 assert(dev_ctx->thread != NULL); 980 spdk_thread_send_msg(dev_ctx->thread, start_io, dev_ctx); 981 __sync_add_and_fetch(&g_num_active_threads, 1); 982 } 983 984 g_app_completion_poller = SPDK_POLLER_REGISTER(check_app_completion, NULL, 1000000); 985 if (g_app_completion_poller == NULL) { 986 fprintf(stderr, "Failed to register a poller for test completion checking.\n"); 987 goto out; 988 } 989 990 return; 991 out: 992 cleanup(); 993 spdk_app_stop(0); 994 } 995 996 static void 997 iscsi_fuzz_usage(void) 998 { 999 fprintf(stderr, " -T <path> iSCSI Target IP address.\n"); 1000 fprintf(stderr, " -S <integer> Seed value for test.\n"); 1001 fprintf(stderr, 1002 " -t <integer> Time in seconds to run the fuzz test. Only valid if -j is not specified.\n"); 1003 } 1004 1005 static int 1006 iscsi_fuzz_parse(int ch, char *arg) 1007 { 1008 int64_t error_test; 1009 1010 switch (ch) { 1011 case 'T': 1012 g_tgt_ip = optarg; 1013 break; 1014 case 'S': 1015 error_test = spdk_strtol(arg, 10); 1016 if (error_test < 0) { 1017 fprintf(stderr, "Invalid value supplied for the random seed.\n"); 1018 return -1; 1019 } else { 1020 g_random_seed = error_test; 1021 } 1022 break; 1023 case 't': 1024 g_runtime = spdk_strtol(optarg, 10); 1025 if (g_runtime <= 0 || g_runtime > MAX_RUNTIME_S) { 1026 fprintf(stderr, "You must supply a positive runtime value less than %d.\n", MAX_RUNTIME_S); 1027 return -1; 1028 } 1029 break; 1030 case '?': 1031 default: 1032 iscsi_fuzz_usage(); 1033 return -EINVAL; 1034 } 1035 1036 return 0; 1037 } 1038 1039 int 1040 main(int argc, char **argv) 1041 { 1042 struct spdk_app_opts opts = {}; 1043 int rc; 1044 1045 g_runtime = DEFAULT_RUNTIME; 1046 srand((unsigned)time(0)); 1047 1048 TAILQ_INIT(&g_get_pdu_list); 1049 1050 spdk_app_opts_init(&opts, sizeof(opts)); 1051 opts.name = "iscsi_fuzz"; 1052 opts.rpc_addr = NULL; 1053 1054 if ((rc = spdk_app_parse_args(argc, argv, &opts, "T:S:t:", NULL, iscsi_fuzz_parse, 1055 iscsi_fuzz_usage) != SPDK_APP_PARSE_ARGS_SUCCESS)) { 1056 return rc; 1057 } 1058 1059 rc = spdk_app_start(&opts, begin_iscsi_fuzz, NULL); 1060 1061 spdk_app_fini(); 1062 return rc; 1063 } 1064