1 /*
2 * Copyright (c) 2022-2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <ctime>
17 #include <thread>
18 #include <vector>
19
20 #include <securec.h>
21
22 #include "data_flow_statistics.h"
23 #include "inet_stats_service.h"
24 #include "net_mgr_log_wrapper.h"
25 #include "net_stats_client.h"
26 #include "net_stats_constants.h"
27 #define private public
28 #include "net_stats_service.h"
29 #include "net_stats_service_stub.h"
30
31 namespace OHOS {
32 namespace NetManagerStandard {
33 namespace {
34 const uint8_t *g_baseFuzzData = nullptr;
35 size_t g_baseFuzzSize = 0;
36 size_t g_baseFuzzPos;
37 constexpr size_t STR_LEN = 10;
38 } // namespace
39
NetStatsGetData()40 template <class T> T NetStatsGetData()
41 {
42 T object{};
43 size_t netStatsSize = sizeof(object);
44 if (g_baseFuzzData == nullptr || netStatsSize > g_baseFuzzSize - g_baseFuzzPos) {
45 return object;
46 }
47 errno_t ret = memcpy_s(&object, netStatsSize, g_baseFuzzData + g_baseFuzzPos, netStatsSize);
48 if (ret != EOK) {
49 return {};
50 }
51 g_baseFuzzPos += netStatsSize;
52 return object;
53 }
54
NetStatsGetString(int strlen)55 std::string NetStatsGetString(int strlen)
56 {
57 char cstr[strlen];
58 cstr[strlen - 1] = '\0';
59 for (int i = 0; i < strlen - 1; i++) {
60 cstr[i] = NetStatsGetData<char>();
61 }
62 std::string str(cstr);
63 return str;
64 }
65
66 class INetStatsCallbackTest : public IRemoteStub<INetStatsCallback> {
67 public:
NetIfaceStatsChanged(const std::string & iface)68 int32_t NetIfaceStatsChanged(const std::string &iface)
69 {
70 return 0;
71 }
72
NetUidStatsChanged(const std::string & iface,uint32_t uid)73 int32_t NetUidStatsChanged(const std::string &iface, uint32_t uid)
74 {
75 return 0;
76 }
77 };
78
79 static bool g_isInited = false;
80
Init()81 void Init()
82 {
83 if (!g_isInited) {
84 DelayedSingleton<NetStatsService>::GetInstance()->Init();
85 g_isInited = true;
86 } else {
87 g_isInited = false;
88 }
89 }
90
OnRemoteRequest(uint32_t code,MessageParcel & data)91 __attribute__((no_sanitize("cfi"))) int32_t OnRemoteRequest(uint32_t code, MessageParcel &data)
92 {
93 if (!g_isInited) {
94 Init();
95 }
96
97 MessageParcel reply;
98 MessageOption option;
99
100 int32_t ret = DelayedSingleton<NetStatsService>::GetInstance()->OnRemoteRequest(code, data, reply, option);
101 return ret;
102 }
103
WriteInterfaceToken(MessageParcel & data)104 bool WriteInterfaceToken(MessageParcel &data)
105 {
106 if (!data.WriteInterfaceToken(NetStatsServiceStub::GetDescriptor())) {
107 return false;
108 }
109 return true;
110 }
111
CheckParamVaild(MessageParcel & dataParcel,const uint8_t * data,size_t size)112 void CheckParamVaild(MessageParcel &dataParcel, const uint8_t *data, size_t size)
113 {
114 if ((data == nullptr) || (size == 0)) {
115 return;
116 }
117 g_baseFuzzData = data;
118 g_baseFuzzSize = size;
119 g_baseFuzzPos = 0;
120
121 if (!WriteInterfaceToken(dataParcel)) {
122 return;
123 }
124
125 return;
126 }
127
RegisterNetStatsCallbackFuzzTest(const uint8_t * data,size_t size)128 void RegisterNetStatsCallbackFuzzTest(const uint8_t *data, size_t size)
129 {
130 if (data == nullptr) {
131 return;
132 }
133
134 sptr<INetStatsCallbackTest> callback = new (std::nothrow) INetStatsCallbackTest();
135 if (callback == nullptr) {
136 return;
137 }
138
139 MessageParcel dataParcel;
140 if (!WriteInterfaceToken(dataParcel)) {
141 return;
142 }
143 CheckParamVaild(dataParcel, data, size);
144 dataParcel.WriteRemoteObject(callback->AsObject().GetRefPtr());
145
146 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_NSM_REGISTER_NET_STATS_CALLBACK), dataParcel);
147 }
148
UnregisterNetStatsCallbackFuzzTest(const uint8_t * data,size_t size)149 void UnregisterNetStatsCallbackFuzzTest(const uint8_t *data, size_t size)
150 {
151 if (data == nullptr) {
152 return;
153 }
154
155 sptr<INetStatsCallbackTest> callback = new (std::nothrow) INetStatsCallbackTest();
156 if (callback == nullptr) {
157 return;
158 }
159
160 MessageParcel dataParcel;
161 if (!WriteInterfaceToken(dataParcel)) {
162 return;
163 }
164 dataParcel.WriteRemoteObject(callback->AsObject().GetRefPtr());
165 CheckParamVaild(dataParcel, data, size);
166
167 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_NSM_UNREGISTER_NET_STATS_CALLBACK), dataParcel);
168 }
169
GetIfaceRxBytesFuzzTest(const uint8_t * data,size_t size)170 __attribute__((no_sanitize("cfi"))) void GetIfaceRxBytesFuzzTest(const uint8_t *data, size_t size)
171 {
172 MessageParcel dataParcel;
173 CheckParamVaild(dataParcel, data, size);
174 std::string interfaceName = NetStatsGetString(STR_LEN);
175 dataParcel.WriteString(interfaceName);
176
177 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_IFACE_RXBYTES), dataParcel);
178 }
179
GetIfaceTxBytesFuzzTest(const uint8_t * data,size_t size)180 void GetIfaceTxBytesFuzzTest(const uint8_t *data, size_t size)
181 {
182 MessageParcel dataParcel;
183 CheckParamVaild(dataParcel, data, size);
184 std::string interfaceName = NetStatsGetString(STR_LEN);
185 dataParcel.WriteString(interfaceName);
186
187 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_IFACE_TXBYTES), dataParcel);
188 }
189
GetUidRxBytesFuzzTest(const uint8_t * data,size_t size)190 void GetUidRxBytesFuzzTest(const uint8_t *data, size_t size)
191 {
192 MessageParcel dataParcel;
193 CheckParamVaild(dataParcel, data, size);
194 uint32_t uid = NetStatsGetData<uint32_t>();
195 dataParcel.WriteUint32(uid);
196
197 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_UID_RXBYTES), dataParcel);
198 }
199
GetUidTxBytesFuzzTest(const uint8_t * data,size_t size)200 void GetUidTxBytesFuzzTest(const uint8_t *data, size_t size)
201 {
202 MessageParcel dataParcel;
203 CheckParamVaild(dataParcel, data, size);
204 uint32_t uid = NetStatsGetData<uint32_t>();
205 dataParcel.WriteUint32(uid);
206
207 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_UID_TXBYTES), dataParcel);
208 }
209
GetCellularRxBytesFuzzTest(const uint8_t * data,size_t size)210 void GetCellularRxBytesFuzzTest(const uint8_t *data, size_t size)
211 {
212 MessageParcel dataParcel;
213 CheckParamVaild(dataParcel, data, size);
214 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_CELLULAR_RXBYTES), dataParcel);
215 }
216
GetCellularTxBytesFuzzTest(const uint8_t * data,size_t size)217 void GetCellularTxBytesFuzzTest(const uint8_t *data, size_t size)
218 {
219 MessageParcel dataParcel;
220 CheckParamVaild(dataParcel, data, size);
221 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_CELLULAR_TXBYTES), dataParcel);
222 }
223
GetAllRxBytesFuzzTest(const uint8_t * data,size_t size)224 void GetAllRxBytesFuzzTest(const uint8_t *data, size_t size)
225 {
226 MessageParcel dataParcel;
227 CheckParamVaild(dataParcel, data, size);
228 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_ALL_RXBYTES), dataParcel);
229 }
230
GetAllTxBytesFuzzTest(const uint8_t * data,size_t size)231 void GetAllTxBytesFuzzTest(const uint8_t *data, size_t size)
232 {
233 MessageParcel dataParcel;
234 CheckParamVaild(dataParcel, data, size);
235 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_ALL_TXBYTES), dataParcel);
236 }
237
GetIfaceStatsDetailFuzzTest(const uint8_t * data,size_t size)238 void GetIfaceStatsDetailFuzzTest(const uint8_t *data, size_t size)
239 {
240 MessageParcel dataParcel;
241 CheckParamVaild(dataParcel, data, size);
242 dataParcel.WriteString(NetStatsGetString(STR_LEN));
243 dataParcel.WriteUint64(NetStatsGetData<uint64_t>());
244 dataParcel.WriteUint64(NetStatsGetData<uint64_t>());
245
246 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_IFACE_STATS_DETAIL), dataParcel);
247 }
248
GetUidStatsDetailFuzzTest(const uint8_t * data,size_t size)249 void GetUidStatsDetailFuzzTest(const uint8_t *data, size_t size)
250 {
251 MessageParcel dataParcel;
252 CheckParamVaild(dataParcel, data, size);
253 dataParcel.WriteString(NetStatsGetString(STR_LEN));
254 dataParcel.WriteUint64(NetStatsGetData<uint32_t>());
255 dataParcel.WriteUint64(NetStatsGetData<uint64_t>());
256 dataParcel.WriteUint64(NetStatsGetData<uint64_t>());
257
258 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_UID_STATS_DETAIL), dataParcel);
259 }
260
UpdateIfacesStatsFuzzTest(const uint8_t * data,size_t size)261 void UpdateIfacesStatsFuzzTest(const uint8_t *data, size_t size)
262 {
263 MessageParcel dataParcel;
264 CheckParamVaild(dataParcel, data, size);
265 dataParcel.WriteString(NetStatsGetString(STR_LEN));
266 dataParcel.WriteUint64(NetStatsGetData<uint64_t>());
267 dataParcel.WriteUint64(NetStatsGetData<uint64_t>());
268 NetStatsInfo stats;
269 stats.iface_ = NetStatsGetString(STR_LEN);
270 stats.uid_ = NetStatsGetData<uint32_t>();
271 stats.date_ = NetStatsGetData<uint64_t>();
272 stats.rxBytes_ = NetStatsGetData<uint64_t>();
273 stats.txBytes_ = NetStatsGetData<uint64_t>();
274 stats.rxPackets_ = NetStatsGetData<uint64_t>();
275 stats.txPackets_ = NetStatsGetData<uint64_t>();
276 stats.Marshalling(dataParcel);
277
278 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_UPDATE_IFACES_STATS), dataParcel);
279 }
280
UpdateStatsDataFuzzTest(const uint8_t * data,size_t size)281 void UpdateStatsDataFuzzTest(const uint8_t *data, size_t size)
282 {
283 MessageParcel dataParcel;
284 CheckParamVaild(dataParcel, data, size);
285 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_UPDATE_STATS_DATA), dataParcel);
286 }
287
ResetFactoryFuzzTest(const uint8_t * data,size_t size)288 void ResetFactoryFuzzTest(const uint8_t *data, size_t size)
289 {
290 MessageParcel dataParcel;
291 CheckParamVaild(dataParcel, data, size);
292 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_NSM_RESET_FACTORY), dataParcel);
293 }
294
GetCookieRxBytesFuzzTest(const uint8_t * data,size_t size)295 void GetCookieRxBytesFuzzTest(const uint8_t *data, size_t size)
296 {
297 MessageParcel dataParcel;
298 CheckParamVaild(dataParcel, data, size);
299 uint64_t cookie = NetStatsGetData<uint64_t>();
300 dataParcel.WriteUint32(cookie);
301
302 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_COOKIE_RXBYTES), dataParcel);
303 }
304
GetCookieTxBytesFuzzTest(const uint8_t * data,size_t size)305 void GetCookieTxBytesFuzzTest(const uint8_t *data, size_t size)
306 {
307 MessageParcel dataParcel;
308 CheckParamVaild(dataParcel, data, size);
309 uint64_t cookie = NetStatsGetData<uint64_t>();
310 dataParcel.WriteUint32(cookie);
311
312 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_COOKIE_TXBYTES), dataParcel);
313 }
314
SetAppStatsFuzzTest(const uint8_t * data,size_t size)315 void SetAppStatsFuzzTest(const uint8_t *data, size_t size)
316 {
317 MessageParcel dataParcel;
318 CheckParamVaild(dataParcel, data, size);
319 uint32_t uid = NetStatsGetData<uint32_t>();
320 std::string iface = NetStatsGetString(STR_LEN);
321 dataParcel.WriteUint32(uid);
322 dataParcel.WriteString(iface);
323 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_SET_APP_STATS), dataParcel);
324 }
325
GetTrafficStatsByNetworkFuzzTest(const uint8_t * data,size_t size)326 void GetTrafficStatsByNetworkFuzzTest(const uint8_t *data, size_t size)
327 {
328 MessageParcel dataParcel;
329 CheckParamVaild(dataParcel, data, size);
330 uint32_t type = NetStatsGetData<uint32_t>();
331 uint32_t startTime = NetStatsGetData<uint64_t>();
332 uint32_t endTime = NetStatsGetData<uint64_t>();
333 dataParcel.WriteUint32(type);
334 dataParcel.WriteUint64(startTime);
335 dataParcel.WriteUint64(endTime);
336 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_TRAFFIC_STATS_BY_NETWORK), dataParcel);
337 }
338
GetTrafficStatsByUidNetworkFuzzTest(const uint8_t * data,size_t size)339 void GetTrafficStatsByUidNetworkFuzzTest(const uint8_t *data, size_t size)
340 {
341 MessageParcel dataParcel;
342 CheckParamVaild(dataParcel, data, size);
343 uint32_t uid = NetStatsGetData<uint32_t>();
344 uint32_t startTime = NetStatsGetData<uint64_t>();
345 uint32_t endTime = NetStatsGetData<uint64_t>();
346 dataParcel.WriteUint32(uid);
347 dataParcel.WriteUint64(startTime);
348 dataParcel.WriteUint64(endTime);
349 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_TRAFFIC_STATS_BY_UID_NETWORK), dataParcel);
350 }
351 } // namespace NetManagerStandard
352 } // namespace OHOS
353
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)354 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
355 {
356 /* Run your code on data */
357 OHOS::NetManagerStandard::RegisterNetStatsCallbackFuzzTest(data, size);
358 OHOS::NetManagerStandard::UnregisterNetStatsCallbackFuzzTest(data, size);
359 OHOS::NetManagerStandard::GetIfaceRxBytesFuzzTest(data, size);
360 OHOS::NetManagerStandard::GetIfaceTxBytesFuzzTest(data, size);
361 OHOS::NetManagerStandard::GetUidRxBytesFuzzTest(data, size);
362 OHOS::NetManagerStandard::GetUidTxBytesFuzzTest(data, size);
363 OHOS::NetManagerStandard::GetCellularRxBytesFuzzTest(data, size);
364 OHOS::NetManagerStandard::GetCellularTxBytesFuzzTest(data, size);
365 OHOS::NetManagerStandard::GetAllRxBytesFuzzTest(data, size);
366 OHOS::NetManagerStandard::GetAllTxBytesFuzzTest(data, size);
367 OHOS::NetManagerStandard::GetIfaceStatsDetailFuzzTest(data, size);
368 OHOS::NetManagerStandard::GetUidStatsDetailFuzzTest(data, size);
369 OHOS::NetManagerStandard::UpdateIfacesStatsFuzzTest(data, size);
370 OHOS::NetManagerStandard::ResetFactoryFuzzTest(data, size);
371 OHOS::NetManagerStandard::GetCookieRxBytesFuzzTest(data, size);
372 OHOS::NetManagerStandard::GetCookieTxBytesFuzzTest(data, size);
373 OHOS::NetManagerStandard::SetAppStatsFuzzTest(data, size);
374 OHOS::NetManagerStandard::GetTrafficStatsByNetworkFuzzTest(data, size);
375 OHOS::NetManagerStandard::GetTrafficStatsByUidNetworkFuzzTest(data, size);
376 return 0;
377 }
378