--- sunrpcfuzz.c.orig 2003-11-16 16:29:33.000000000 -0800 +++ sunrpcfuzz.c 2003-11-16 17:11:00.000000000 -0800 @@ -16,7 +16,7 @@ #define ARRAY_SIZE 32 #define BIG_BUF 65535 -int fuzzprog(char*, struct onc_endpoint, uint, uint, uint, uint); +int fuzzprog(char*, struct onc_endpoint, uint, uint, uint, uint,uint); static int caught_sigpipe=0; @@ -43,7 +43,8 @@ printf("\t-i \tDo 'n' fuzzed messages per procedure\n"); printf("\t-l \t'n' is last procedure to test\n"); printf("\t-f \t'n' is first procedure to test\n"); - printf("\t-r \tPush 'n' random xdr items onto the SPIKE\n\n"); + printf("\t-r \tPush 'n' random xdr items onto the SPIKE\n"); + printf("\t-x \tUse 'n' for XID\n\n"); } int @@ -67,8 +68,9 @@ ep.progver = 0; ep.proto = 0; ep.port = 0; + uint XID = NULL; - while ((c = getopt(argc, argv, "h:v:p:as:i:l:f:r:t")) != -1) + while ((c = getopt(argc, argv, "h:v:p:as:i:l:f:r:x:t")) != -1) { switch (c) { @@ -103,6 +105,9 @@ case 't': throttle = 1; break; + case 'x': + XID = atol(optarg); + break; default: usage(argv[0]); @@ -134,7 +139,7 @@ if (portmapgetport) { s_onc_do_portmap_getport(host, &ep); if (ep.port != 0) { - fuzzprog(host, ep, iterations, minprocnum, maxprocnum, number_of_items); + fuzzprog(host, ep, iterations, minprocnum, maxprocnum, number_of_items, XID); } else { printf("Could not query port for RPC Program: %u\n", @@ -146,7 +151,7 @@ if (portmapdump) { arraysize = s_onc_do_portmap_dump(host, eparray, ARRAY_SIZE); for (i = 0; i < arraysize; i++) { - fuzzprog(host, eparray[i], iterations, minprocnum, maxprocnum, number_of_items); + fuzzprog(host, eparray[i], iterations, minprocnum, maxprocnum, number_of_items,XID); } } @@ -166,7 +171,7 @@ * fail) 1 - success of some sort */ int -fuzzprog(char* host, struct onc_endpoint ep, uint iterations, uint minprocnum, uint maxprocnum, uint number_of_items) +fuzzprog(char* host, struct onc_endpoint ep, uint iterations, uint minprocnum, uint maxprocnum, uint number_of_items,uint XID) { uint i = 0; uint j = 0; @@ -177,7 +182,7 @@ uint responsebufsize = BIG_BUF; uint responsedatasize = BIG_BUF; - uint xid = 0; + uint xid = XID; char ourhost[256] = {'\0'}; char bogushost[512] = {'\0'}; uint gids = 0; @@ -207,6 +212,7 @@ responsedatasize = BIG_BUF; /* generate a new random XID for this RPC message */ + if(XID == NULL) xid = (uint)rand(); /* if the protocol is TCP (6), then we need to add 'record framing' for * this message