1 /*
2 * Copyright (c) 2022-2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "netshare_client_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20 #include <iosfwd>
21 #include <memory>
22 #include <new>
23 #include <string>
24
25 #include <securec.h>
26
27 #include "refbase.h"
28 #include "singleton.h"
29 #ifdef WIFI_MODOULE
30 #include "wifi_ap_msg.h"
31 #endif
32
33 #include "inetwork_share_service.h"
34 #include "interface_configuration.h"
35 #include "net_manager_ext_constants.h"
36 #include "netmanager_ext_test_security.h"
37 #include "netmgr_ext_log_wrapper.h"
38 #define private public
39 #include "networkshare_service.h"
40
41 namespace OHOS {
42 namespace NetManagerStandard {
43 namespace {
44 const uint8_t *g_baseFuzzData = nullptr;
45 static constexpr uint32_t CREATE_SHARE_IFACE_TYPE_VALUE = 3;
46 static constexpr uint32_t CREATE_SHARE_IFACE_STATE_VALUE = 3;
47 static constexpr uint32_t ENUM_TYPE_VALUE3 = 3;
48 #ifdef BLUETOOTH_MODOULE
49 static constexpr uint32_t ENUM_TYPE_VALUE4 = 4;
50 #endif
51 static constexpr uint32_t ENUM_TYPE_VALUE5 = 5;
52 #ifdef WIFI_MODOULE
53 static constexpr uint32_t ENUM_TYPE_VALUE6 = 6;
54 #endif
55 static constexpr uint32_t ENUM_TYPE_BEGIN = 1;
56 static constexpr uint32_t LIMIT_RUN_NUMBER = 5;
57 size_t g_baseFuzzSize = 0;
58 size_t g_baseFuzzPos;
59 uint32_t g_testRunTimes = 0;
60 constexpr size_t IFACE_LEN = 5;
61 constexpr uint8_t NET_FAMILY_IPV4 = 1;
62 constexpr uint8_t NET_FAMILY_IPV6 = 2;
63 } // namespace
64
GetData()65 template <class T> T GetData()
66 {
67 T object{};
68 size_t objectSize = sizeof(object);
69 if (g_baseFuzzData == nullptr || objectSize > g_baseFuzzSize - g_baseFuzzPos) {
70 return object;
71 }
72 errno_t ret = memcpy_s(&object, objectSize, g_baseFuzzData + g_baseFuzzPos, objectSize);
73 if (ret != EOK) {
74 return {};
75 }
76 g_baseFuzzPos += objectSize;
77 return object;
78 }
79
GetStringFromData(int strlen)80 std::string GetStringFromData(int strlen)
81 {
82 char cstr[strlen];
83 cstr[strlen - 1] = '\0';
84 for (int i = 0; i < strlen - 1; i++) {
85 cstr[i] = GetData<char>();
86 }
87 std::string str(cstr);
88 return str;
89 }
90
InitGlobalData(const uint8_t * data,size_t size)91 bool InitGlobalData(const uint8_t *data, size_t size)
92 {
93 if (data == nullptr || size == 0) {
94 return false;
95 }
96 g_baseFuzzData = data;
97 g_baseFuzzSize = size;
98 g_baseFuzzPos = 0;
99 return true;
100 }
101
102 class INetShareCallbackTest : public IRemoteStub<ISharingEventCallback> {
103 public:
OnSharingStateChanged(const bool & isRunning)104 void OnSharingStateChanged(const bool &isRunning)
105 {
106 return;
107 }
OnInterfaceSharingStateChanged(const SharingIfaceType & type,const std::string & iface,const SharingIfaceState & state)108 void OnInterfaceSharingStateChanged(const SharingIfaceType &type, const std::string &iface,
109 const SharingIfaceState &state)
110 {
111 return;
112 }
OnSharingUpstreamChanged(const sptr<NetHandle> netHandle)113 void OnSharingUpstreamChanged(const sptr<NetHandle> netHandle)
114 {
115 return;
116 }
117 };
118
119 class SubStateMachineCallbackTest : public NetworkShareSubStateMachine::SubStateMachineCallback {
OnUpdateInterfaceState(const std::shared_ptr<NetworkShareSubStateMachine> & paraSubStateMachine,int state,int lastError)120 void OnUpdateInterfaceState(const std::shared_ptr<NetworkShareSubStateMachine> ¶SubStateMachine, int state,
121 int lastError)
122 {
123 }
124 };
125
126 class NotifyUpstreamCallbackTest : public NetworkShareUpstreamMonitor::NotifyUpstreamCallback {
OnUpstreamStateChanged(int32_t msgName,int32_t param1)127 void OnUpstreamStateChanged(int32_t msgName, int32_t param1) {}
OnUpstreamStateChanged(int32_t msgName,int32_t param1,int32_t param2,const std::any & messageObj)128 void OnUpstreamStateChanged(int32_t msgName, int32_t param1, int32_t param2, const std::any &messageObj) {}
129 };
130
131 static bool g_isInited = false;
Init()132 void Init()
133 {
134 if (!g_isInited) {
135 DelayedSingleton<NetworkShareService>::GetInstance()->Init();
136 g_isInited = true;
137 }
138 }
139
OnRemoteRequest(TetheringInterfaceCode code,MessageParcel & data)140 __attribute__((no_sanitize("cfi"))) int32_t OnRemoteRequest(TetheringInterfaceCode code, MessageParcel &data)
141 {
142 if (!g_isInited) {
143 Init();
144 }
145
146 MessageParcel reply;
147 MessageOption option;
148
149 return DelayedSingleton<NetworkShareService>::GetInstance()->OnRemoteRequest(static_cast<uint32_t>(code), data,
150 reply, option);
151 }
152
WriteInterfaceToken(MessageParcel & data)153 bool WriteInterfaceToken(MessageParcel &data)
154 {
155 if (!data.WriteInterfaceToken(NetworkShareServiceStub::GetDescriptor())) {
156 return false;
157 }
158 return true;
159 }
160
GetMessageParcel(const uint8_t * data,size_t size,MessageParcel & dataParcel)161 bool GetMessageParcel(const uint8_t *data, size_t size, MessageParcel &dataParcel)
162 {
163 if (!InitGlobalData(data, size)) {
164 return false;
165 }
166
167 NetManagerExtAccessToken token;
168
169 if (!WriteInterfaceToken(dataParcel)) {
170 return false;
171 }
172 int32_t type = GetData<int32_t>() % CREATE_SHARE_IFACE_TYPE_VALUE;
173 dataParcel.WriteInt32(type);
174
175 return true;
176 }
177
IsNetworkSharingSupportedFuzzTest(const uint8_t * data,size_t size)178 void IsNetworkSharingSupportedFuzzTest(const uint8_t *data, size_t size)
179 {
180 NETMGR_EXT_LOG_D("IsNetworkSharingSupportedFuzzTest enter");
181 if (!InitGlobalData(data, size)) {
182 return;
183 }
184 NetManagerExtAccessToken token;
185
186 MessageParcel dataParcel;
187 if (!WriteInterfaceToken(dataParcel)) {
188 return;
189 }
190
191 OnRemoteRequest(TetheringInterfaceCode::CMD_GET_SHARING_SUPPORTED, dataParcel);
192 }
193
IsSharingFuzzTest(const uint8_t * data,size_t size)194 void IsSharingFuzzTest(const uint8_t *data, size_t size)
195 {
196 NETMGR_EXT_LOG_D("IsSharingFuzzTest enter");
197 if (!InitGlobalData(data, size)) {
198 return;
199 }
200
201 NetManagerExtAccessToken token;
202
203 MessageParcel dataParcel;
204 if (!WriteInterfaceToken(dataParcel)) {
205 return;
206 }
207
208 OnRemoteRequest(TetheringInterfaceCode::CMD_GET_IS_SHARING, dataParcel);
209 }
210
StartNetworkSharingFuzzTest(const uint8_t * data,size_t size)211 void StartNetworkSharingFuzzTest(const uint8_t *data, size_t size)
212 {
213 NETMGR_EXT_LOG_D("StartNetworkSharingFuzzTest enter");
214
215 MessageParcel dataParcel;
216 if (!GetMessageParcel(data, size, dataParcel)) {
217 return;
218 }
219
220 OnRemoteRequest(TetheringInterfaceCode::CMD_START_NETWORKSHARE, dataParcel);
221 }
222
StopNetworkSharingFuzzTest(const uint8_t * data,size_t size)223 void StopNetworkSharingFuzzTest(const uint8_t *data, size_t size)
224 {
225 NETMGR_EXT_LOG_D("StopNetworkSharingFuzzTest enter");
226 MessageParcel dataParcel;
227 if (!GetMessageParcel(data, size, dataParcel)) {
228 return;
229 }
230 OnRemoteRequest(TetheringInterfaceCode::CMD_STOP_NETWORKSHARE, dataParcel);
231 }
232
GetSharableRegexsFuzzTest(const uint8_t * data,size_t size)233 void GetSharableRegexsFuzzTest(const uint8_t *data, size_t size)
234 {
235 NETMGR_EXT_LOG_D("GetSharableRegexsFuzzTest enter");
236 MessageParcel dataParcel;
237 if (!GetMessageParcel(data, size, dataParcel)) {
238 return;
239 }
240 OnRemoteRequest(TetheringInterfaceCode::CMD_GET_SHARABLE_REGEXS, dataParcel);
241 }
242
GetSharingStateFuzzTest(const uint8_t * data,size_t size)243 void GetSharingStateFuzzTest(const uint8_t *data, size_t size)
244 {
245 NETMGR_EXT_LOG_D("GetSharingStateFuzzTest enter");
246 MessageParcel dataParcel;
247 if (!GetMessageParcel(data, size, dataParcel)) {
248 return;
249 }
250 OnRemoteRequest(TetheringInterfaceCode::CMD_GET_SHARING_STATE, dataParcel);
251 }
252
GetNetSharingIfacesFuzzTest(const uint8_t * data,size_t size)253 void GetNetSharingIfacesFuzzTest(const uint8_t *data, size_t size)
254 {
255 NETMGR_EXT_LOG_D("GetNetSharingIfacesFuzzTest enter");
256 if (!InitGlobalData(data, size)) {
257 return;
258 }
259
260 NetManagerExtAccessToken token;
261
262 MessageParcel dataParcel;
263 if (!WriteInterfaceToken(dataParcel)) {
264 return;
265 }
266 uint32_t state = GetData<int32_t>() % CREATE_SHARE_IFACE_STATE_VALUE + ENUM_TYPE_BEGIN;
267 dataParcel.WriteInt32(state);
268 OnRemoteRequest(TetheringInterfaceCode::CMD_GET_SHARING_IFACES, dataParcel);
269 }
270
RegisterSharingEventFuzzTest(const uint8_t * data,size_t size)271 void RegisterSharingEventFuzzTest(const uint8_t *data, size_t size)
272 {
273 NETMGR_EXT_LOG_D("RegisterSharingEventFuzzTest enter");
274 if (!InitGlobalData(data, size)) {
275 return;
276 }
277
278 NetManagerExtAccessToken token;
279
280 sptr<ISharingEventCallback> callback = new (std::nothrow) INetShareCallbackTest();
281 MessageParcel dataParcel;
282 if (!WriteInterfaceToken(dataParcel)) {
283 return;
284 }
285 dataParcel.WriteRemoteObject(callback->AsObject());
286 OnRemoteRequest(TetheringInterfaceCode::CMD_REGISTER_EVENT_CALLBACK, dataParcel);
287 }
288
UnregisterSharingEventFuzzTest(const uint8_t * data,size_t size)289 void UnregisterSharingEventFuzzTest(const uint8_t *data, size_t size)
290 {
291 NETMGR_EXT_LOG_D("UnregisterSharingEventFuzzTest enter");
292 if (!InitGlobalData(data, size)) {
293 return;
294 }
295
296 NetManagerExtAccessToken token;
297
298 sptr<ISharingEventCallback> callback = new (std::nothrow) INetShareCallbackTest();
299 MessageParcel dataParcel;
300 if (!WriteInterfaceToken(dataParcel)) {
301 return;
302 }
303 dataParcel.WriteRemoteObject(callback->AsObject());
304 OnRemoteRequest(TetheringInterfaceCode::CMD_UNREGISTER_EVENT_CALLBACK, dataParcel);
305 }
306
GetStatsRxBytesFuzzTest(const uint8_t * data,size_t size)307 void GetStatsRxBytesFuzzTest(const uint8_t *data, size_t size)
308 {
309 NETMGR_EXT_LOG_D("GetStatsRxBytesFuzzTest enter");
310 if (!InitGlobalData(data, size)) {
311 return;
312 }
313
314 NetManagerExtAccessToken token;
315
316 MessageParcel dataParcel;
317 if (!WriteInterfaceToken(dataParcel)) {
318 return;
319 }
320 OnRemoteRequest(TetheringInterfaceCode::CMD_GET_RX_BYTES, dataParcel);
321 }
322
GetStatsTxBytesFuzzTest(const uint8_t * data,size_t size)323 void GetStatsTxBytesFuzzTest(const uint8_t *data, size_t size)
324 {
325 NETMGR_EXT_LOG_D("GetStatsTxBytesFuzzTest enter");
326 if (!InitGlobalData(data, size)) {
327 return;
328 }
329
330 NetManagerExtAccessToken token;
331
332 MessageParcel dataParcel;
333 if (!WriteInterfaceToken(dataParcel)) {
334 return;
335 }
336 OnRemoteRequest(TetheringInterfaceCode::CMD_GET_TX_BYTES, dataParcel);
337 }
338
GetStatsTotalBytesFuzzTest(const uint8_t * data,size_t size)339 void GetStatsTotalBytesFuzzTest(const uint8_t *data, size_t size)
340 {
341 NETMGR_EXT_LOG_D("GetStatsTotalBytesFuzzTest enter");
342 if (!InitGlobalData(data, size)) {
343 return;
344 }
345
346 NetManagerExtAccessToken token;
347
348 MessageParcel dataParcel;
349 if (!WriteInterfaceToken(dataParcel)) {
350 return;
351 }
352 OnRemoteRequest(TetheringInterfaceCode::CMD_GET_TOTAL_BYTES, dataParcel);
353 }
354
NetGetStatsBytesFuzzTest(const uint8_t * data,size_t size)355 void NetGetStatsBytesFuzzTest(const uint8_t *data, size_t size)
356 {
357 if (g_testRunTimes < LIMIT_RUN_NUMBER) {
358 GetStatsRxBytesFuzzTest(data, size);
359 GetStatsTxBytesFuzzTest(data, size);
360 GetStatsTotalBytesFuzzTest(data, size);
361 }
362 }
363
NetworkShareMainStateMachineFuzzTest(const uint8_t * data,size_t size)364 __attribute__((no_sanitize("cfi"))) void NetworkShareMainStateMachineFuzzTest(const uint8_t *data, size_t size)
365 {
366 NETMGR_EXT_LOG_D("NetworkShareMainStateMachineFuzzTest enter");
367 if (!InitGlobalData(data, size)) {
368 return;
369 }
370
371 std::shared_ptr<NetworkShareUpstreamMonitor> networkmonitor =
372 NetworkShareUpstreamMonitor::GetInstance();
373
374 auto networkShareMainStateMachine = std::make_unique<NetworkShareMainStateMachine>(networkmonitor);
375 int32_t errType = GetData<int32_t>();
376 networkShareMainStateMachine->SwitcheToErrorState(errType);
377 int32_t newState = GetData<int32_t>();
378 networkShareMainStateMachine->MainSmStateSwitch(newState);
379 int32_t anyNum = GetData<int32_t>();
380 networkShareMainStateMachine->TurnOnMainShareSettings();
381 networkShareMainStateMachine->TurnOffMainShareSettings();
382 MessageIfaceActive messageIfaceActive;
383 messageIfaceActive.value_ = anyNum;
384 networkShareMainStateMachine->HandleInitInterfaceStateActive(messageIfaceActive);
385 networkShareMainStateMachine->HandleInitInterfaceStateInactive(messageIfaceActive);
386 auto networkShareMainStateMachine1 = std::make_unique<NetworkShareMainStateMachine>(networkmonitor);
387 networkShareMainStateMachine1->HandleAliveInterfaceStateActive(messageIfaceActive);
388 networkShareMainStateMachine1->HandleAliveInterfaceStateInactive(messageIfaceActive);
389 MessageUpstreamInfo upstreamNetInfo;
390 upstreamNetInfo.cmd_ = anyNum;
391 auto networkShareMainStateMachine3 = std::make_unique<NetworkShareMainStateMachine>(networkmonitor);
392 networkShareMainStateMachine3->HandleAliveUpstreamMonitorCallback(upstreamNetInfo);
393 networkShareMainStateMachine3->HandleErrorInterfaceStateInactive(messageIfaceActive);
394 networkShareMainStateMachine3->HandleErrorClear(upstreamNetInfo);
395 auto networkShareMainStateMachine2 = std::make_unique<NetworkShareMainStateMachine>(networkmonitor);
396 networkShareMainStateMachine2->InitStateEnter();
397 networkShareMainStateMachine2->AliveStateEnter();
398 networkShareMainStateMachine2->ErrorStateEnter();
399 networkShareMainStateMachine2->InitStateExit();
400 networkShareMainStateMachine2->AliveStateExit();
401 networkShareMainStateMachine2->ErrorStateExit();
402 networkShareMainStateMachine2->ChooseUpstreamNetwork();
403 networkShareMainStateMachine2->DisableForward();
404 networkShareMainStateMachine2->EraseSharedSubSM(messageIfaceActive);
405 }
406
NetworkShareSubStateMachineFuzzTest(const uint8_t * data,size_t size)407 void NetworkShareSubStateMachineFuzzTest(const uint8_t *data, size_t size)
408 {
409 NETMGR_EXT_LOG_D("NetworkShareSubStateMachineFuzzTest enter");
410 if (!InitGlobalData(data, size)) {
411 return;
412 }
413
414 std::shared_ptr<NetworkShareConfiguration> configuration;
415 std::string ifaceName = GetStringFromData(IFACE_LEN);
416 SharingIfaceType interfaceType = static_cast<SharingIfaceType>(GetData<uint32_t>() % CREATE_SHARE_IFACE_TYPE_VALUE);
417 auto networkShareSubStateMachine =
418 std::make_unique<NetworkShareSubStateMachine>(ifaceName, interfaceType, configuration);
419
420 networkShareSubStateMachine->GetNetShareType();
421 networkShareSubStateMachine->GetInterfaceName();
422 int32_t newState = GetData<int32_t>();
423 networkShareSubStateMachine->SubSmStateSwitch(newState);
424 std::string downIface = GetStringFromData(IFACE_LEN);
425 networkShareSubStateMachine->GetDownIfaceName(downIface);
426 std::string upIface = GetStringFromData(IFACE_LEN);
427 int32_t num = GetData<int32_t>();
428 sptr<NetHandle> netHandle = new (std::nothrow) NetHandle(num);
429 sptr<NetAllCapabilities> netcap = new (std::nothrow) NetManagerStandard::NetAllCapabilities();
430 sptr<NetLinkInfo> netlinkinfo = new (std::nothrow) NetManagerStandard::NetLinkInfo();
431 networkShareSubStateMachine->GetUpIfaceName(upIface);
432 }
433
DonetworkShareSubStateMachine(std::unique_ptr<NetworkShareSubStateMachine> & networkShareSubStateMachine,std::shared_ptr<UpstreamNetworkInfo> upstreamNetInfo,std::shared_ptr<INetAddr> addr,std::string str)434 void DonetworkShareSubStateMachine(std::unique_ptr<NetworkShareSubStateMachine> &networkShareSubStateMachine,
435 std::shared_ptr<UpstreamNetworkInfo> upstreamNetInfo,
436 std::shared_ptr<INetAddr> addr,
437 std::string str)
438 {
439 networkShareSubStateMachine->CreateInitStateTable();
440 networkShareSubStateMachine->CreateSharedStateTable();
441 networkShareSubStateMachine->InitStateEnter();
442 networkShareSubStateMachine->SharedStateEnter();
443 networkShareSubStateMachine->UnavailableStateEnter();
444 networkShareSubStateMachine->InitStateExit();
445 networkShareSubStateMachine->SharedStateExit();
446 networkShareSubStateMachine->UnavailableStateExit();
447 networkShareSubStateMachine->HandleInitSharingRequest(upstreamNetInfo);
448 networkShareSubStateMachine->HandleInitInterfaceDown(upstreamNetInfo);
449 networkShareSubStateMachine->HandleSharedUnrequest(upstreamNetInfo);
450 networkShareSubStateMachine->HandleSharedInterfaceDown(upstreamNetInfo);
451 networkShareSubStateMachine->HandleSharedConnectionChange(upstreamNetInfo);
452 networkShareSubStateMachine->HandleSharedErrors(upstreamNetInfo);
453 networkShareSubStateMachine->ConfigureShareDhcp(GetData<int32_t>() > 0);
454 networkShareSubStateMachine->RequestIpv4Address(addr);
455 networkShareSubStateMachine->StartDhcp(addr);
456 networkShareSubStateMachine->StopDhcp();
457 networkShareSubStateMachine->AddIpv6AddrToLocalNetwork();
458 networkShareSubStateMachine->AddIpv6InfoToLocalNetwork();
459 networkShareSubStateMachine->StartIpv6();
460 networkShareSubStateMachine->StopIpv6();
461 networkShareSubStateMachine->HandleConnectionChanged(upstreamNetInfo);
462 networkShareSubStateMachine->HandleConnection();
463 networkShareSubStateMachine->RemoveRoutesToLocalNetwork();
464 networkShareSubStateMachine->AddRoutesToLocalNetwork();
465 networkShareSubStateMachine->CleanupUpstreamInterface();
466 networkShareSubStateMachine->HasChangeUpstreamIfaceSet(str);
467 networkShareSubStateMachine->GetWifiHotspotDhcpFlag();
468 networkShareSubStateMachine->GetBtDestinationAddr(str);
469 networkShareSubStateMachine->GetWifiApDestinationAddr(str);
470 networkShareSubStateMachine->GetUsbDestinationAddr(str);
471 networkShareSubStateMachine->CheckConfig(str, str);
472 networkShareSubStateMachine->FindDestinationAddr(str);
473 }
474
NetworkShareSubStateMachinePrivateFuzzTest(const uint8_t * data,size_t size)475 void NetworkShareSubStateMachinePrivateFuzzTest(const uint8_t *data, size_t size)
476 {
477 NETMGR_EXT_LOG_D("NetworkShareSubStateMachinePrivateFuzzTest enter");
478 if (!InitGlobalData(data, size)) {
479 return;
480 }
481 std::shared_ptr<NetworkShareConfiguration> config;
482 std::string str = GetStringFromData(IFACE_LEN);
483 SharingIfaceType interfaceType = static_cast<SharingIfaceType>(GetData<uint32_t>() % CREATE_SHARE_IFACE_TYPE_VALUE);
484 auto networkShareSubStateMachine = std::make_unique<NetworkShareSubStateMachine>(str, interfaceType, config);
485 sptr<NetHandle> handle = new (std::nothrow) NetHandle(GetData<int32_t>());
486 sptr<NetAllCapabilities> netcap = new (std::nothrow) NetManagerStandard::NetAllCapabilities();
487 sptr<NetLinkInfo> link = new (std::nothrow) NetManagerStandard::NetLinkInfo();
488 std::shared_ptr<UpstreamNetworkInfo> upstreamNetInfo = std::make_shared<UpstreamNetworkInfo>(handle, netcap, link);
489 std::shared_ptr<INetAddr> addr = std::make_shared<INetAddr>();
490 addr->family_ = GetData<int8_t>();
491 addr->prefixlen_ = GetData<int8_t>();
492 addr->address_ = str;
493 addr->netMask_ = str;
494 addr->hostName_ = str;
495 addr->port_ = GetData<int8_t>();
496 DonetworkShareSubStateMachine(networkShareSubStateMachine, upstreamNetInfo, addr, str);
497 }
498
UpstreammonitorFuzzTest(const uint8_t * data,size_t size)499 void UpstreammonitorFuzzTest(const uint8_t *data, size_t size)
500 {
501 NETMGR_EXT_LOG_D("UpstreammonitorFuzzTest enter");
502 if (!InitGlobalData(data, size)) {
503 return;
504 }
505
506 int32_t num = GetData<int32_t>();
507 std::shared_ptr<NetworkShareUpstreamMonitor> networkmonitor =
508 NetworkShareUpstreamMonitor::GetInstance();
509
510 networkmonitor->ListenDefaultNetwork();
511 sptr<NetHandle> netHandle = new (std::nothrow) NetHandle(num);
512 sptr<NetAllCapabilities> netcap = new (std::nothrow) NetManagerStandard::NetAllCapabilities();
513 sptr<NetLinkInfo> netlinkinfo = new (std::nothrow) NetManagerStandard::NetLinkInfo();
514 std::shared_ptr<UpstreamNetworkInfo> upstreamNetInfo =
515 std::make_shared<UpstreamNetworkInfo>(netHandle, netcap, netlinkinfo);
516 networkmonitor->GetCurrentGoodUpstream(upstreamNetInfo);
517
518 networkmonitor->NotifyMainStateMachine(num, upstreamNetInfo);
519 networkmonitor->NotifyMainStateMachine(num);
520 networkmonitor->HandleNetAvailable(netHandle);
521 networkmonitor->HandleNetCapabilitiesChange(netHandle, netcap);
522 networkmonitor->HandleConnectionPropertiesChange(netHandle, netlinkinfo);
523 networkmonitor->HandleNetLost(netHandle);
524 }
525
NetworkShareTrackerFuzzTest(const uint8_t * data,size_t size)526 void NetworkShareTrackerFuzzTest(const uint8_t *data, size_t size)
527 {
528 NETMGR_EXT_LOG_D("NetworkShareTrackerFuzzTest enter");
529 if (!InitGlobalData(data, size)) {
530 return;
531 }
532
533 int32_t num = GetData<int32_t>();
534 std::string iface = GetStringFromData(IFACE_LEN);
535 sptr<NetHandle> netHandle = new (std::nothrow) NetHandle(num);
536 sptr<NetAllCapabilities> netcap = new (std::nothrow) NetManagerStandard::NetAllCapabilities();
537 sptr<NetLinkInfo> netlinkinfo = new (std::nothrow) NetManagerStandard::NetLinkInfo();
538 SharingIfaceType ifaceType = SharingIfaceType(SharingIfaceType(num % ENUM_TYPE_VALUE3));
539 SharingIfaceState ifaceState = SharingIfaceState((num % ENUM_TYPE_VALUE3) + ENUM_TYPE_BEGIN);
540 TrafficType trafficTYpe = TrafficType((num % ENUM_TYPE_VALUE3) + ENUM_TYPE_BEGIN);
541 int32_t supported = 0;
542 int32_t sharingStatus = 0;
543 std::vector<std::string> ifaceRegexs;
544 std::vector<std::string> ifaces;
545 int32_t kbByte = 0;
546 auto wifiHotspotCallback = sptr<NetworkShareTracker::WifiHotspotCallback>::MakeSptr();
547 NetworkShareTracker::GetInstance().Uninit();
548 wifiHotspotCallback->OnHotspotStateChanged(num);
549 NetworkShareTracker::GetInstance().IsNetworkSharingSupported(supported);
550 NetworkShareTracker::GetInstance().IsSharing(sharingStatus);
551 NetworkShareTracker::GetInstance().StartNetworkSharing(ifaceType);
552 NetworkShareTracker::GetInstance().StopNetworkSharing(ifaceType);
553 NetworkShareTracker::GetInstance().GetSharableRegexs(ifaceType, ifaceRegexs);
554 NetworkShareTracker::GetInstance().GetSharingState(ifaceType, ifaceState);
555 NetworkShareTracker::GetInstance().GetNetSharingIfaces(ifaceState, ifaces);
556 sptr<INetShareCallbackTest> callback = new (std::nothrow) INetShareCallbackTest();
557 NetworkShareTracker::GetInstance().RegisterSharingEvent(callback);
558 NetworkShareTracker::GetInstance().UnregisterSharingEvent(callback);
559 NetworkShareTracker::GetInstance().UpstreamWanted();
560 std::shared_ptr<NetworkShareSubStateMachine> subSm =
561 std::make_shared<NetworkShareSubStateMachine>(iface, ifaceType, nullptr);
562 NetworkShareTracker::GetInstance().ModifySharedSubStateMachineList(num > 0, subSm);
563 NetworkShareTracker::GetInstance().GetMainStateMachine();
564 std::shared_ptr<UpstreamNetworkInfo> upstreamNetInfo =
565 std::make_shared<UpstreamNetworkInfo>(netHandle, netcap, netlinkinfo);
566 NetworkShareTracker::GetInstance().SetUpstreamNetHandle(upstreamNetInfo);
567 NetworkShareTracker::GetInstance().GetUpstreamInfo(upstreamNetInfo);
568 NetworkShareTracker::GetInstance().NotifyDownstreamsHasNewUpstreamIface(upstreamNetInfo);
569 /*
570 * There will be operations of the fork process here, and it is necessary to limit the number of runs. Otherwise,
571 * frequent high-speed calls to the FUZZ test case will cause insufficient resources and lead to downtime.
572 */
573 if (g_testRunTimes < LIMIT_RUN_NUMBER) {
574 NetworkShareTracker::GetInstance().GetSharedSubSMTraffic(trafficTYpe, kbByte);
575 g_testRunTimes++;
576 }
577 }
578
NetworkShareTrackerPrivateFuzzTest(const uint8_t * data,size_t size)579 void NetworkShareTrackerPrivateFuzzTest(const uint8_t *data, size_t size)
580 {
581 NETMGR_EXT_LOG_D("NetworkShareTrackerPrivateFuzzTest enter");
582 if (!InitGlobalData(data, size)) {
583 return;
584 }
585
586 int32_t num = GetData<int32_t>();
587 std::string iface = GetStringFromData(IFACE_LEN);
588 sptr<NetHandle> netHandle = new (std::nothrow) NetHandle(num);
589 SharingIfaceType ifaceType = SharingIfaceType(SharingIfaceType(num % ENUM_TYPE_VALUE3));
590 std::shared_ptr<NetworkShareSubStateMachine> subSm =
591 std::make_shared<NetworkShareSubStateMachine>(iface, ifaceType, nullptr);
592 SharingIfaceState ifaceState = SharingIfaceState((num % ENUM_TYPE_VALUE3) + ENUM_TYPE_BEGIN);
593
594 auto &tra = NetworkShareTracker::GetInstance();
595 tra.HandleSubSmUpdateInterfaceState(subSm, num, num);
596 tra.EnableNetSharingInternal(ifaceType, num > 0);
597 tra.SetWifiNetworkSharing(num > 0);
598 #ifdef USB_MODOULE
599 tra.SetUsbNetworkSharing(num > 0);
600 #endif
601 tra.SetBluetoothNetworkSharing(num > 0);
602 tra.EnableWifiSubStateMachine();
603 tra.EnableBluetoothSubStateMachine();
604 tra.Sharing(iface, num);
605 tra.SendGlobalSharingStateChange();
606 tra.SendIfaceSharingStateChange(ifaceType, iface, ifaceState);
607 tra.SendSharingUpstreamChange(netHandle);
608 tra.CreateSubStateMachine(iface, ifaceType, num > 0);
609 tra.StopSubStateMachine(iface, ifaceType);
610 tra.IsInterfaceMatchType(iface, ifaceType);
611 tra.InterfaceNameToType(iface, ifaceType);
612 tra.IsHandleNetlinkEvent(ifaceType, num > 0);
613 tra.FindSubStateMachine(iface, ifaceType, subSm, iface);
614 tra.InterfaceAdded(iface);
615 tra.InterfaceRemoved(iface);
616 tra.InterfaceStatusChanged(iface, num > 0);
617 tra.SetDnsForwarders(*netHandle);
618 tra.StopDnsProxy();
619 tra.SubSmStateToExportState(num);
620 tra.RegisterBtPanCallback();
621 #ifdef WIFI_MODOULE
622 tra.RegisterWifiApCallback();
623 tra.SetWifiState(Wifi::ApState(num % ENUM_TYPE_VALUE6));
624 #endif
625 #ifdef BLUETOOTH_MODOULE
626 tra.SetBluetoothState(Bluetooth::BTConnectState(num % ENUM_TYPE_VALUE4));
627 #endif
628 tra.SendMainSMEvent(subSm, num, num);
629 }
630
NetworkShareHisysEventFuzzTest(const uint8_t * data,size_t size)631 void NetworkShareHisysEventFuzzTest(const uint8_t *data, size_t size)
632 {
633 NETMGR_EXT_LOG_D("NetworkShareHisysEventFuzzTest enter");
634 if (!InitGlobalData(data, size)) {
635 return;
636 }
637
638 int32_t num = GetData<int32_t>();
639 std::string str = GetStringFromData(IFACE_LEN);
640 SharingIfaceType ifaceType = SharingIfaceType(SharingIfaceType(num % ENUM_TYPE_VALUE3));
641 NetworkShareEventType eventType = NetworkShareEventType(num % ENUM_TYPE_VALUE3);
642 NetworkShareEventOperator eventOper = NetworkShareEventOperator(num % ENUM_TYPE_VALUE5);
643 auto &hisys = NetworkShareHisysEvent::GetInstance();
644 hisys.SendFaultEvent(eventOper, NetworkShareEventErrorType::ERROR_CANCEL_FORWARD, str, eventType);
645 hisys.SendFaultEvent(ifaceType, eventOper, NetworkShareEventErrorType::ERROR_CANCEL_FORWARD, str, eventType);
646 hisys.SendBehaviorEvent(num, ifaceType);
647 }
648
NetworkShareConfigurationFuzzTest(const uint8_t * data,size_t size)649 void NetworkShareConfigurationFuzzTest(const uint8_t *data, size_t size)
650 {
651 NETMGR_EXT_LOG_D("NetworkShareConfigurationFuzzTest enter");
652 if (!InitGlobalData(data, size)) {
653 return;
654 }
655
656 std::string str = GetStringFromData(IFACE_LEN);
657 std::vector<std::string> match = {"wlan", "softap", "usb"};
658
659 NetworkShareConfiguration config;
660 config.IsNetworkSharingSupported();
661 config.IsUsbIface(str);
662 config.IsWifiIface(str);
663 config.IsBluetoothIface(str);
664 config.GetUsbIfaceRegexs();
665 config.GetWifiIfaceRegexs();
666 config.GetBluetoothIfaceRegexs();
667 config.GetWifiHotspotSetDhcpFlag();
668 config.GetBtpanIpv4Addr();
669 config.GetWifiHotspotIpv4Addr();
670 config.GetUsbRndisIpv4Addr();
671 config.GetRouteSuffix();
672 config.GetBtpanDhcpServerName();
673 config.GetWifiHotspotDhcpServerName();
674 config.GetUsbRndisDhcpServerName();
675 config.GetDefaultMask();
676 config.GetDhcpEndIP();
677
678 config.LoadConfigData();
679 config.MatchesDownstreamRegexs(str, match);
680 config.ReadConfigFile();
681 config.ParseLineData(str, str);
682 std::vector<std::string> res;
683 config.ParseRegexsData(res, str);
684 }
685
GetShareIpv6PrefixFuzzTest(const uint8_t * data,size_t size)686 void GetShareIpv6PrefixFuzzTest(const uint8_t *data, size_t size)
687 {
688 NETMGR_EXT_LOG_D("GetShareIpv6PrefixFuzzTest enter");
689 if (!InitGlobalData(data, size)) {
690 return;
691 }
692
693 std::string str = GetStringFromData(IFACE_LEN);
694 std::shared_ptr<NetworkShareConfiguration> config;
695 SharingIfaceType interfaceType = static_cast<SharingIfaceType>(GetData<uint32_t>() % CREATE_SHARE_IFACE_TYPE_VALUE);
696 auto networkShareSubStateMachine = std::make_unique<NetworkShareSubStateMachine>(str, interfaceType, config);
697 std::string iface = GetStringFromData(IFACE_LEN);
698 networkShareSubStateMachine->GetShareIpv6Prefix(iface);
699 networkShareSubStateMachine->MacToEui64Addr(iface);
700 networkShareSubStateMachine->GenerateIpv6(iface);
701 }
702
ConfigureShareIpv4FuzzTest(const uint8_t * data,size_t size)703 void ConfigureShareIpv4FuzzTest(const uint8_t *data, size_t size)
704 {
705 NETMGR_EXT_LOG_D("ConfigureShareIpv4FuzzTest enter");
706 if (!InitGlobalData(data, size)) {
707 return;
708 }
709
710 std::string str = GetStringFromData(IFACE_LEN);
711 std::shared_ptr<NetworkShareConfiguration> config;
712 SharingIfaceType interfaceType = static_cast<SharingIfaceType>(GetData<uint32_t>() % CREATE_SHARE_IFACE_TYPE_VALUE);
713 auto networkShareSubStateMachine = std::make_unique<NetworkShareSubStateMachine>(str, interfaceType, config);
714 sptr<NetLinkInfo> upstreamLinkInfo = new NetLinkInfo();
715 INetAddr inetAddr;
716 inetAddr.family_ = NET_FAMILY_IPV4;
717 upstreamLinkInfo->netAddrList_.push_back(inetAddr);
718 networkShareSubStateMachine->ConfigureShareIpv4(upstreamLinkInfo);
719 }
720
ConfigureShareIpv6FuzzTest(const uint8_t * data,size_t size)721 void ConfigureShareIpv6FuzzTest(const uint8_t *data, size_t size)
722 {
723 NETMGR_EXT_LOG_D("ConfigureShareIpv6FuzzTest enter");
724 if (!InitGlobalData(data, size)) {
725 return;
726 }
727
728 std::string str = GetStringFromData(IFACE_LEN);
729 std::shared_ptr<NetworkShareConfiguration> config;
730 SharingIfaceType interfaceType = static_cast<SharingIfaceType>(GetData<uint32_t>() % CREATE_SHARE_IFACE_TYPE_VALUE);
731 auto networkShareSubStateMachine = std::make_unique<NetworkShareSubStateMachine>(str, interfaceType, config);
732 sptr<NetLinkInfo> upstreamLinkInfo = new NetLinkInfo();
733 INetAddr inetAddr;
734 inetAddr.family_ = NET_FAMILY_IPV6;
735 upstreamLinkInfo->netAddrList_.push_back(inetAddr);
736 networkShareSubStateMachine->ConfigureShareIpv6(upstreamLinkInfo);
737 networkShareSubStateMachine->StopIpv6();
738 IpPrefix ipPrefix;
739 networkShareSubStateMachine->lastRaParams_.prefixes_.push_back(ipPrefix);
740 networkShareSubStateMachine->StartIpv6();
741 networkShareSubStateMachine->StopIpv6();
742 networkShareSubStateMachine->lastRaParams_.prefixes_.push_back(ipPrefix);
743 networkShareSubStateMachine->AddIpv6AddrToLocalNetwork();
744 }
745
GetUsbDestinationAddrFuzzTest(const uint8_t * data,size_t size)746 void GetUsbDestinationAddrFuzzTest(const uint8_t *data, size_t size)
747 {
748 NETMGR_EXT_LOG_D("GetUsbDestinationAddrFuzzTest enter");
749 if (!InitGlobalData(data, size)) {
750 return;
751 }
752
753 std::string str = GetStringFromData(IFACE_LEN);
754 std::shared_ptr<NetworkShareConfiguration> config;
755 SharingIfaceType interfaceType = static_cast<SharingIfaceType>(GetData<uint32_t>() % CREATE_SHARE_IFACE_TYPE_VALUE);
756 auto networkShareSubStateMachine = std::make_unique<NetworkShareSubStateMachine>(str, interfaceType, config);
757 networkShareSubStateMachine->configuration_ = std::make_shared<NetworkShareConfiguration>();
758 networkShareSubStateMachine->GetWifiHotspotDhcpFlag();
759 std::string addrStr;
760 networkShareSubStateMachine->GetUsbDestinationAddr(addrStr);
761 networkShareSubStateMachine->configuration_->usbIpv4Str_ = "192.168.1.1";
762 networkShareSubStateMachine->GetUsbDestinationAddr(addrStr);
763 networkShareSubStateMachine->configuration_->routeSuffix_ = "10";
764 networkShareSubStateMachine->GetUsbDestinationAddr(addrStr);
765 std::shared_ptr<INetAddr> netAddr = nullptr;
766 networkShareSubStateMachine->StartDhcp(netAddr);
767 }
768 } // namespace NetManagerStandard
769 } // namespace OHOS
770
771 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)772 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
773 {
774 /* Run your code on data */
775 OHOS::NetManagerStandard::IsNetworkSharingSupportedFuzzTest(data, size);
776 OHOS::NetManagerStandard::IsSharingFuzzTest(data, size);
777 OHOS::NetManagerStandard::StartNetworkSharingFuzzTest(data, size);
778 OHOS::NetManagerStandard::StopNetworkSharingFuzzTest(data, size);
779 OHOS::NetManagerStandard::GetSharableRegexsFuzzTest(data, size);
780 OHOS::NetManagerStandard::GetSharingStateFuzzTest(data, size);
781 OHOS::NetManagerStandard::GetNetSharingIfacesFuzzTest(data, size);
782 OHOS::NetManagerStandard::RegisterSharingEventFuzzTest(data, size);
783 OHOS::NetManagerStandard::UnregisterSharingEventFuzzTest(data, size);
784 OHOS::NetManagerStandard::NetworkShareConfigurationFuzzTest(data, size);
785 OHOS::NetManagerStandard::UpstreammonitorFuzzTest(data, size);
786 OHOS::NetManagerStandard::NetworkShareTrackerFuzzTest(data, size);
787 OHOS::NetManagerStandard::NetworkShareTrackerPrivateFuzzTest(data, size);
788 OHOS::NetManagerStandard::NetworkShareSubStateMachineFuzzTest(data, size);
789 OHOS::NetManagerStandard::NetworkShareSubStateMachinePrivateFuzzTest(data, size);
790 OHOS::NetManagerStandard::NetworkShareMainStateMachineFuzzTest(data, size);
791 OHOS::NetManagerStandard::NetworkShareHisysEventFuzzTest(data, size);
792 OHOS::NetManagerStandard::NetGetStatsBytesFuzzTest(data, size);
793 OHOS::NetManagerStandard::GetShareIpv6PrefixFuzzTest(data, size);
794 OHOS::NetManagerStandard::ConfigureShareIpv4FuzzTest(data, size);
795 OHOS::NetManagerStandard::ConfigureShareIpv6FuzzTest(data, size);
796 OHOS::NetManagerStandard::GetUsbDestinationAddrFuzzTest(data, size);
797 return 0;
798 }
799