1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "ethernet_client_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20 #include <iosfwd>
21 #include <memory>
22 #include <new>
23 #include <securec.h>
24 #include <string>
25
26 #include "accesstoken_kit.h"
27 #include "refbase.h"
28 #include "singleton.h"
29 #include "token_setproc.h"
30
31 #include "dev_interface_state.h"
32 #define private public
33 #include "ethernet_client.h"
34 #include "ethernet_service.h"
35 #include "interface_configuration.h"
36
37 namespace OHOS {
38 namespace NetManagerStandard {
39 namespace {
40 const uint8_t *g_baseFuzzData = nullptr;
41 static constexpr uint32_t CREATE_BOOL_TYPE_VALUE = 2;
42 size_t g_baseFuzzSize = 0;
43 size_t g_baseFuzzPos;
44 constexpr size_t IFACE_LEN = 5;
45
46 using namespace Security::AccessToken;
47 using Security::AccessToken::AccessTokenID;
48 HapInfoParams testInfoParms = {.userID = 1,
49 .bundleName = "ethernet_client_fuzzer",
50 .instIndex = 0,
51 .appIDDesc = "test"};
52
53 PermissionDef testPermDef = {.permissionName = "ohos.permission.GET_NETWORK_INFO",
54 .bundleName = "ethernet_client_fuzzer",
55 .grantMode = 1,
56 .availableLevel = OHOS::Security::AccessToken::ATokenAplEnum::APL_SYSTEM_BASIC,
57 .label = "label",
58 .labelId = 1,
59 .description = "Test ethernet maneger network info",
60 .descriptionId = 1};
61
62 PermissionDef testInternetPermDef = {.permissionName = "ohos.permission.CONNECTIVITY_INTERNAL",
63 .bundleName = "net_conn_client_fuzzer",
64 .grantMode = 1,
65 .availableLevel = OHOS::Security::AccessToken::ATokenAplEnum::APL_SYSTEM_BASIC,
66 .label = "label",
67 .labelId = 1,
68 .description = "Test ethernet connectivity internet",
69 .descriptionId = 1};
70
71 PermissionStateFull testState = {.permissionName = "ohos.permission.GET_NETWORK_INFO",
72 .isGeneral = true,
73 .resDeviceID = {"local"},
74 .grantStatus = {PermissionState::PERMISSION_GRANTED},
75 .grantFlags = {2}};
76
77 PermissionStateFull testInternetState = {.permissionName = "ohos.permission.CONNECTIVITY_INTERNAL",
78 .isGeneral = true,
79 .resDeviceID = {"local"},
80 .grantStatus = {PermissionState::PERMISSION_GRANTED},
81 .grantFlags = {2}};
82
83 HapPolicyParams testPolicyPrams = {.apl = APL_SYSTEM_BASIC,
84 .domain = "test.domain",
85 .permList = {testPermDef},
86 .permStateList = {testState}};
87
88 HapPolicyParams testInternetPolicyPrams = {.apl = APL_SYSTEM_BASIC,
89 .domain = "test.domain",
90 .permList = {testPermDef, testInternetPermDef},
91 .permStateList = {testState, testInternetState}};
92 } // namespace
93
GetData()94 template <class T> T GetData()
95 {
96 T object{};
97 size_t objectSize = sizeof(object);
98 if (g_baseFuzzData == nullptr || objectSize > g_baseFuzzSize - g_baseFuzzPos) {
99 return object;
100 }
101 errno_t ret = memcpy_s(&object, objectSize, g_baseFuzzData + g_baseFuzzPos, objectSize);
102 if (ret != EOK) {
103 return {};
104 }
105 g_baseFuzzPos += objectSize;
106 return object;
107 }
108 class AccessToken {
109 public:
AccessToken()110 AccessToken()
111 {
112 currentID_ = GetSelfTokenID();
113 AccessTokenIDEx tokenIdEx = AccessTokenKit::AllocHapToken(testInfoParms, testPolicyPrams);
114 accessID_ = tokenIdEx.tokenIdExStruct.tokenID;
115 SetSelfTokenID(accessID_);
116 }
~AccessToken()117 ~AccessToken()
118 {
119 AccessTokenKit::DeleteToken(accessID_);
120 SetSelfTokenID(currentID_);
121 }
122
123 private:
124 AccessTokenID currentID_ = 0;
125 AccessTokenID accessID_ = 0;
126 };
127
128 class AccessTokenInternetInfo {
129 public:
AccessTokenInternetInfo()130 AccessTokenInternetInfo()
131 {
132 currentID_ = GetSelfTokenID();
133 AccessTokenIDEx tokenIdEx = AccessTokenKit::AllocHapToken(testInfoParms, testInternetPolicyPrams);
134 accessID_ = tokenIdEx.tokenIdExStruct.tokenID;
135 SetSelfTokenID(accessID_);
136 }
~AccessTokenInternetInfo()137 ~AccessTokenInternetInfo()
138 {
139 AccessTokenKit::DeleteToken(accessID_);
140 SetSelfTokenID(currentID_);
141 }
142
143 private:
144 AccessTokenID currentID_ = 0;
145 AccessTokenID accessID_ = 0;
146 };
147
GetStringFromData(int strlen)148 std::string GetStringFromData(int strlen)
149 {
150 char cstr[strlen];
151 cstr[strlen - 1] = '\0';
152 for (int i = 0; i < strlen - 1; i++) {
153 cstr[i] = GetData<char>();
154 }
155 std::string str(cstr);
156 return str;
157 }
158
159 static bool g_isInited = false;
160
Init()161 void Init()
162 {
163 if (!g_isInited) {
164 DelayedSingleton<EthernetService>::GetInstance()->Init();
165 g_isInited = true;
166 }
167 }
168
WriteInterfaceToken(MessageParcel & data)169 bool WriteInterfaceToken(MessageParcel &data)
170 {
171 if (!data.WriteInterfaceToken(EthernetServiceStub::GetDescriptor())) {
172 return false;
173 }
174 return true;
175 }
176
OnRemoteRequest(uint32_t code,MessageParcel & data)177 int32_t OnRemoteRequest(uint32_t code, MessageParcel &data)
178 {
179 if (!g_isInited) {
180 Init();
181 }
182
183 MessageParcel reply;
184 MessageOption option;
185 return DelayedSingleton<EthernetService>::GetInstance()->OnRemoteRequest(code, data, reply, option);
186 }
187
SetIfaceConfigFuzzTest(const uint8_t * data,size_t size)188 void SetIfaceConfigFuzzTest(const uint8_t *data, size_t size)
189 {
190 if ((data == nullptr) || (size == 0)) {
191 return;
192 }
193 g_baseFuzzData = data;
194 g_baseFuzzSize = size;
195 g_baseFuzzPos = 0;
196 AccessToken token;
197 AccessTokenInternetInfo tokenInfo;
198
199 MessageParcel parcel;
200 WriteInterfaceToken(parcel);
201 std::string iface = GetStringFromData(IFACE_LEN);
202 if (!parcel.WriteString(iface)) {
203 return;
204 }
205 auto ic = std::make_unique<InterfaceConfiguration>();
206 if (!ic->Marshalling(parcel)) {
207 return;
208 }
209 OnRemoteRequest(EthernetService::CMD_SET_IF_CFG, parcel);
210 }
211
GetIfaceConfigFuzzTest(const uint8_t * data,size_t size)212 void GetIfaceConfigFuzzTest(const uint8_t *data, size_t size)
213 {
214 if ((data == nullptr) || (size == 0)) {
215 return;
216 }
217 g_baseFuzzData = data;
218 g_baseFuzzSize = size;
219 g_baseFuzzPos = 0;
220 AccessToken token;
221 AccessTokenInternetInfo tokenInfo;
222 MessageParcel parcel;
223 std::string iface = GetStringFromData(IFACE_LEN);
224 WriteInterfaceToken(parcel);
225 if (!parcel.WriteString(iface)) {
226 return;
227 }
228 OnRemoteRequest(EthernetService::CMD_GET_IF_CFG, parcel);
229 }
230
IsIfaceActiveFuzzTest(const uint8_t * data,size_t size)231 void IsIfaceActiveFuzzTest(const uint8_t *data, size_t size)
232 {
233 if ((data == nullptr) || (size == 0)) {
234 return;
235 }
236 g_baseFuzzData = data;
237 g_baseFuzzSize = size;
238 g_baseFuzzPos = 0;
239 AccessToken token;
240 AccessTokenInternetInfo tokenInfo;
241 MessageParcel parcel;
242 std::string iface = GetStringFromData(IFACE_LEN);
243 WriteInterfaceToken(parcel);
244 if (!parcel.WriteString(iface)) {
245 return;
246 }
247 OnRemoteRequest(EthernetService::CMD_IS_ACTIVATE, parcel);
248 }
249
GetAllActiveIfacesFuzzTest(const uint8_t * data,size_t size)250 void GetAllActiveIfacesFuzzTest(const uint8_t *data, size_t size)
251 {
252 if ((data == nullptr) || (size == 0)) {
253 return;
254 }
255 AccessToken token;
256 AccessTokenInternetInfo tokenInfo;
257 MessageParcel parcel;
258 WriteInterfaceToken(parcel);
259 OnRemoteRequest(EthernetService::CMD_GET_ACTIVATE_INTERFACE, parcel);
260 }
261
ResetFactoryFuzzTest(const uint8_t * data,size_t size)262 void ResetFactoryFuzzTest(const uint8_t *data, size_t size)
263 {
264 if ((data == nullptr) || (size == 0)) {
265 return;
266 }
267 MessageParcel parcel;
268 WriteInterfaceToken(parcel);
269 OnRemoteRequest(EthernetService::CMD_RESET_FACTORY, parcel);
270 }
271
SetInterfaceUpFuzzTest(const uint8_t * data,size_t size)272 void SetInterfaceUpFuzzTest(const uint8_t *data, size_t size)
273 {
274 if ((data == nullptr) || (size == 0)) {
275 return;
276 }
277 AccessToken token;
278 AccessTokenInternetInfo tokenInfo;
279 g_baseFuzzData = data;
280 g_baseFuzzSize = size;
281 g_baseFuzzPos = 0;
282 MessageParcel parcel;
283 std::string iface = GetStringFromData(IFACE_LEN);
284 WriteInterfaceToken(parcel);
285 if (!parcel.WriteString(iface)) {
286 return;
287 }
288 OnRemoteRequest(EthernetService::CMD_SET_INTERFACE_UP, parcel);
289 }
290
SetInterfaceDownFuzzTest(const uint8_t * data,size_t size)291 void SetInterfaceDownFuzzTest(const uint8_t *data, size_t size)
292 {
293 if ((data == nullptr) || (size == 0)) {
294 return;
295 }
296 AccessToken token;
297 AccessTokenInternetInfo tokenInfo;
298 g_baseFuzzData = data;
299 g_baseFuzzSize = size;
300 g_baseFuzzPos = 0;
301 MessageParcel parcel;
302 std::string iface = GetStringFromData(IFACE_LEN);
303 WriteInterfaceToken(parcel);
304 if (!parcel.WriteString(iface)) {
305 return;
306 }
307 OnRemoteRequest(EthernetService::CMD_SET_INTERFACE_DOWN, parcel);
308 }
309
GetInterfaceConfigFuzzTest(const uint8_t * data,size_t size)310 void GetInterfaceConfigFuzzTest(const uint8_t *data, size_t size)
311 {
312 if ((data == nullptr) || (size == 0)) {
313 return;
314 }
315 AccessToken token;
316 AccessTokenInternetInfo tokenInfo;
317 g_baseFuzzData = data;
318 g_baseFuzzSize = size;
319 g_baseFuzzPos = 0;
320 MessageParcel parcel;
321 std::string iface = GetStringFromData(IFACE_LEN);
322 WriteInterfaceToken(parcel);
323 if (!parcel.WriteString(iface)) {
324 return;
325 }
326 OnRemoteRequest(EthernetService::CMD_GET_INTERFACE_CONFIG, parcel);
327 }
328
EthernetServiceCommonFuzzTest(const uint8_t * data,size_t size)329 void EthernetServiceCommonFuzzTest(const uint8_t *data, size_t size)
330 {
331 if ((data == nullptr) || (size == 0)) {
332 return;
333 }
334 g_baseFuzzData = data;
335 g_baseFuzzSize = size;
336 g_baseFuzzPos = 0;
337
338 auto ethernetServiceCommon = std::make_unique<EthernetServiceCommon>();
339
340 ethernetServiceCommon->ResetEthernetFactory();
341 }
342
EthernetManagementFuzzTest(const uint8_t * data,size_t size)343 void EthernetManagementFuzzTest(const uint8_t *data, size_t size)
344 {
345 if ((data == nullptr) || (size == 0)) {
346 return;
347 }
348 g_baseFuzzData = data;
349 g_baseFuzzSize = size;
350 g_baseFuzzPos = 0;
351
352 auto ethernetManagement = std::make_unique<EthernetManagement>();
353 EthernetDhcpCallback::DhcpResult dhcpResult;
354 ethernetManagement->UpdateDevInterfaceLinkInfo(dhcpResult);
355
356 std::string dev = GetStringFromData(IFACE_LEN);
357 bool up = GetData<uint32_t>() % CREATE_BOOL_TYPE_VALUE == 0;
358 ethernetManagement->UpdateInterfaceState(dev, up);
359
360 std::string iface = GetStringFromData(IFACE_LEN);
361 sptr<InterfaceConfiguration> cfg;
362 ethernetManagement->UpdateDevInterfaceCfg(iface, cfg);
363
364 sptr<InterfaceConfiguration> ifaceConfig;
365 ethernetManagement->GetDevInterfaceCfg(iface, ifaceConfig);
366
367 int32_t activeStatus = 0;
368 ethernetManagement->IsIfaceActive(iface, activeStatus);
369
370 std::vector<std::string> result;
371 ethernetManagement->GetAllActiveIfaces(result);
372
373 ethernetManagement->ResetFactory();
374 std::string devName = GetStringFromData(IFACE_LEN);
375 ethernetManagement->DevInterfaceAdd(devName);
376 ethernetManagement->DevInterfaceRemove(devName);
377 }
378
EthernetDhcpControllerFuzzTest(const uint8_t * data,size_t size)379 void EthernetDhcpControllerFuzzTest(const uint8_t *data, size_t size)
380 {
381 if ((data == nullptr) || (size == 0)) {
382 return;
383 }
384 g_baseFuzzData = data;
385 g_baseFuzzSize = size;
386 g_baseFuzzPos = 0;
387
388 auto ethernetDhcpController = std::make_unique<EthernetDhcpController>();
389
390 sptr<EthernetDhcpCallback> callback;
391 ethernetDhcpController->RegisterDhcpCallback(callback);
392
393 std::string iface = GetStringFromData(IFACE_LEN);
394 bool bIpv6 = GetData<uint32_t>() % CREATE_BOOL_TYPE_VALUE == 0;
395 ethernetDhcpController->StartDhcpClient(iface, bIpv6);
396
397 ethernetDhcpController->StopDhcpClient(iface, bIpv6);
398 }
399 } // namespace NetManagerStandard
400 } // namespace OHOS
401
402 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)403 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
404 {
405 /* Run your code on data */
406 OHOS::NetManagerStandard::SetIfaceConfigFuzzTest(data, size);
407 OHOS::NetManagerStandard::GetIfaceConfigFuzzTest(data, size);
408 OHOS::NetManagerStandard::IsIfaceActiveFuzzTest(data, size);
409 OHOS::NetManagerStandard::GetAllActiveIfacesFuzzTest(data, size);
410 OHOS::NetManagerStandard::ResetFactoryFuzzTest(data, size);
411 OHOS::NetManagerStandard::SetInterfaceUpFuzzTest(data, size);
412 OHOS::NetManagerStandard::SetInterfaceDownFuzzTest(data, size);
413 OHOS::NetManagerStandard::GetInterfaceConfigFuzzTest(data, size);
414 OHOS::NetManagerStandard::EthernetServiceCommonFuzzTest(data, size);
415 OHOS::NetManagerStandard::EthernetManagementFuzzTest(data, size);
416 OHOS::NetManagerStandard::EthernetDhcpControllerFuzzTest(data, size);
417 return 0;
418 }