1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <string>
17 #include <vector>
18 #include <fuzzer/FuzzedDataProvider.h>
19 #include "device_manager_service.h"
20 #include "device_manager_service_impl.h"
21 #include "authenticate_device_service_impl_fuzzer.h"
22 #include "accesstoken_kit.h"
23 #include "nativetoken_kit.h"
24 #include "token_setproc.h"
25
26 namespace OHOS {
27 namespace DistributedHardware {
28 DmPublishInfo publishInfo = {
29 .publishId = 1234,
30 .mode = DmDiscoverMode::DM_DISCOVER_MODE_ACTIVE,
31 .freq = DmExchangeFreq::DM_MID,
32 .ranging = true,
33 };
34
35 PeerTargetId peerTargetId = {
36 .deviceId = "deviceId",
37 .brMac = "brMac",
38 .bleMac = "bleMac",
39 .wifiIp = "wifiIp",
40 .wifiPort = 1,
41 };
42
43 std::vector<DmDeviceInfo> deviceList;
44 std::map<std::string, std::string> bindParam;
45 std::string g_returnJsonStr;
46 int32_t g_eventId = 1;
47 int32_t g_action = 1;
48 int32_t g_authType = -1;
49 uint16_t g_subscribeId = 123;
50 int32_t USLEEP_TIME_US_5000000 = 5000000;
51
52 std::string g_reqJsonStr = R"(
53 {
54 "userId":"4269DC28B639681698809A67EDAD08E39F207900038F91EFF95DD042FE2874E4"
55 }
56 )";
57
58 std::string g_credentialInfo = R"(
59 {
60 "processType" : 1,
61 "authType" : 1,
62 "userId" : "123",
63 "credentialData" :
64 [
65 {
66 "credentialType" : 1,
67 "credentialId" : "104",
68 "authCode" : "1234567812345678123456781234567812345678123456781234567812345678",
69 "serverPk" : "",
70 "pkInfoSignature" : "",
71 "pkInfo" : "",
72 "peerDeviceId" : ""
73 }
74 ]
75 }
76 )";
77
78 std::string g_deleteInfo = R"(
79 {
80 "processType" : 1,
81 "authType" : 1,
82 "userId" : "123"
83 }
84 )";
85
AddPermission()86 void AddPermission()
87 {
88 const int32_t permsNum = 3;
89 const int32_t indexZero = 0;
90 const int32_t indexOne = 1;
91 const int32_t indexTwo = 2;
92 uint64_t tokenId;
93 const char *perms[permsNum];
94 perms[indexZero] = "ohos.permission.ACCESS_SERVICE_DM";
95 perms[indexOne] = "ohos.permission.DISTRIBUTED_DATASYNC";
96 perms[indexTwo] = "ohos.permission.DISTRIBUTED_SOFTBUS_CENTER";
97 NativeTokenInfoParams infoInstance = {
98 .dcapsNum = 0,
99 .permsNum = permsNum,
100 .aclsNum = 0,
101 .dcaps = NULL,
102 .perms = perms,
103 .acls = NULL,
104 .processName = "device_manager",
105 .aplStr = "system_core",
106 };
107 tokenId = GetAccessTokenId(&infoInstance);
108 SetSelfTokenID(tokenId);
109 OHOS::Security::AccessToken::AccessTokenKit::ReloadNativeTokenInfo();
110 }
111
AuthenticateDeviceServiceImplFuzzTest(const uint8_t * data,size_t size)112 void AuthenticateDeviceServiceImplFuzzTest(const uint8_t* data, size_t size)
113 {
114 if ((data == nullptr) || (size == 0) || (size < sizeof(int32_t))) {
115 return;
116 }
117
118 std::string str(reinterpret_cast<const char*>(data), size);
119 FuzzedDataProvider fdp(data, size);
120 int32_t bindLevel = fdp.ConsumeIntegral<int32_t>();
121 AddPermission();
122 DmSubscribeInfo subscribeInfo = {
123 .subscribeId = 0,
124 .mode = DmDiscoverMode::DM_DISCOVER_MODE_ACTIVE,
125 .medium = DmExchangeMedium::DM_AUTO,
126 .freq = DmExchangeFreq::DM_MID,
127 .isSameAccount = true,
128 .isWakeRemote = true,
129 };
130 if (strcpy_s(subscribeInfo.capability, DM_MAX_DEVICE_CAPABILITY_LEN, "capability")) {
131 return;
132 }
133 std::shared_ptr<DeviceManagerServiceListener> listener = std::make_shared<DeviceManagerServiceListener>();
134 auto deviceManagerServiceImpl = std::make_shared<DeviceManagerServiceImpl>();
135
136 deviceManagerServiceImpl->Initialize(listener);
137 deviceManagerServiceImpl->RegisterUiStateCallback(str);
138 deviceManagerServiceImpl->RegisterCredentialCallback(str);
139 deviceManagerServiceImpl->UnAuthenticateDevice(str, str, bindLevel);
140 deviceManagerServiceImpl->UnBindDevice(str, str, bindLevel);
141 deviceManagerServiceImpl->SetUserOperation(str, g_action, str);
142 deviceManagerServiceImpl->RequestCredential(g_reqJsonStr, g_returnJsonStr);
143 deviceManagerServiceImpl->ImportCredential(str, g_credentialInfo);
144 deviceManagerServiceImpl->DeleteCredential(str, g_deleteInfo);
145 deviceManagerServiceImpl->MineRequestCredential(str, g_returnJsonStr);
146 deviceManagerServiceImpl->CheckCredential(str, g_reqJsonStr, g_returnJsonStr);
147 deviceManagerServiceImpl->ImportCredential(str, g_reqJsonStr, g_returnJsonStr);
148 deviceManagerServiceImpl->DeleteCredential(str, g_reqJsonStr, g_returnJsonStr);
149 deviceManagerServiceImpl->NotifyEvent(str, g_eventId, str);
150 deviceManagerServiceImpl->GetGroupType(deviceList);
151 deviceManagerServiceImpl->GetUdidHashByNetWorkId(str.c_str(), str);
152 deviceManagerServiceImpl->ImportAuthCode(str, str);
153 deviceManagerServiceImpl->ExportAuthCode(str);
154 deviceManagerServiceImpl->BindTarget(str, peerTargetId, bindParam);
155 deviceManagerServiceImpl->UnRegisterCredentialCallback(str);
156 deviceManagerServiceImpl->UnRegisterUiStateCallback(str);
157 usleep(USLEEP_TIME_US_5000000);
158 deviceManagerServiceImpl->Release();
159 }
160 }
161 }
162
163 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)164 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
165 {
166 /* Run your code on data */
167 OHOS::DistributedHardware::AuthenticateDeviceServiceImplFuzzTest(data, size);
168
169 return 0;
170 }