1 /*
2 * Copyright (c) 2022-2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <ctime>
17 #include <thread>
18 #include <vector>
19
20 #include <securec.h>
21
22 #include "data_flow_statistics.h"
23 #include "i_net_stats_service.h"
24 #include "net_mgr_log_wrapper.h"
25 #include "net_stats_client.h"
26 #include "net_stats_constants.h"
27 #define private public
28 #include "net_stats_service.h"
29 #include "net_stats_service_stub.h"
30
31 namespace OHOS {
32 namespace NetManagerStandard {
33 namespace {
34 const uint8_t *g_baseFuzzData = nullptr;
35 size_t g_baseFuzzSize = 0;
36 size_t g_baseFuzzPos;
37 constexpr size_t STR_LEN = 10;
38 } // namespace
39
GetData()40 template <class T> T GetData()
41 {
42 T object{};
43 size_t objectSize = sizeof(object);
44 if (g_baseFuzzData == nullptr || objectSize > g_baseFuzzSize - g_baseFuzzPos) {
45 return object;
46 }
47 errno_t ret = memcpy_s(&object, objectSize, g_baseFuzzData + g_baseFuzzPos, objectSize);
48 if (ret != EOK) {
49 return {};
50 }
51 g_baseFuzzPos += objectSize;
52 return object;
53 }
54
GetStringFromData(int strlen)55 std::string GetStringFromData(int strlen)
56 {
57 char cstr[strlen];
58 cstr[strlen - 1] = '\0';
59 for (int i = 0; i < strlen - 1; i++) {
60 cstr[i] = GetData<char>();
61 }
62 std::string str(cstr);
63 return str;
64 }
65
66 class INetStatsCallbackTest : public IRemoteStub<INetStatsCallback> {
67 public:
NetIfaceStatsChanged(const std::string & iface)68 int32_t NetIfaceStatsChanged(const std::string &iface)
69 {
70 return 0;
71 }
72
NetUidStatsChanged(const std::string & iface,uint32_t uid)73 int32_t NetUidStatsChanged(const std::string &iface, uint32_t uid)
74 {
75 return 0;
76 }
77 };
78
79 static bool g_isInited = false;
80
Init()81 void Init()
82 {
83 if (!g_isInited) {
84 DelayedSingleton<NetStatsService>::GetInstance()->Init();
85 g_isInited = false;
86 } else {
87 g_isInited = true;
88 }
89 }
90
OnRemoteRequest(uint32_t code,MessageParcel & data)91 int32_t OnRemoteRequest(uint32_t code, MessageParcel &data)
92 {
93 if (!g_isInited) {
94 Init();
95 }
96
97 MessageParcel reply;
98 MessageOption option;
99
100 int32_t ret = DelayedSingleton<NetStatsService>::GetInstance()->OnRemoteRequest(code, data, reply, option);
101 return ret;
102 }
103
WriteInterfaceToken(MessageParcel & data)104 bool WriteInterfaceToken(MessageParcel &data)
105 {
106 if (!data.WriteInterfaceToken(NetStatsServiceStub::GetDescriptor())) {
107 return false;
108 }
109 return true;
110 }
111
RegisterNetStatsCallbackFuzzTest(const uint8_t * data,size_t size)112 void RegisterNetStatsCallbackFuzzTest(const uint8_t *data, size_t size)
113 {
114 if ((data == nullptr) || (size == 0)) {
115 return;
116 }
117
118 sptr<INetStatsCallbackTest> callback = new (std::nothrow) INetStatsCallbackTest();
119 if (callback == nullptr) {
120 return;
121 }
122
123 MessageParcel dataParcel;
124 if (!WriteInterfaceToken(dataParcel)) {
125 return;
126 }
127 dataParcel.WriteRemoteObject(callback->AsObject().GetRefPtr());
128
129 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_NSM_REGISTER_NET_STATS_CALLBACK), dataParcel);
130 }
131
UnregisterNetStatsCallbackFuzzTest(const uint8_t * data,size_t size)132 void UnregisterNetStatsCallbackFuzzTest(const uint8_t *data, size_t size)
133 {
134 if ((data == nullptr) || (size == 0)) {
135 return;
136 }
137
138 sptr<INetStatsCallbackTest> callback = new (std::nothrow) INetStatsCallbackTest();
139 if (callback == nullptr) {
140 return;
141 }
142
143 MessageParcel dataParcel;
144 if (!WriteInterfaceToken(dataParcel)) {
145 return;
146 }
147 dataParcel.WriteRemoteObject(callback->AsObject().GetRefPtr());
148
149 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_NSM_UNREGISTER_NET_STATS_CALLBACK), dataParcel);
150 }
151
GetIfaceRxBytesFuzzTest(const uint8_t * data,size_t size)152 void GetIfaceRxBytesFuzzTest(const uint8_t *data, size_t size)
153 {
154 if ((data == nullptr) || (size == 0)) {
155 return;
156 }
157 g_baseFuzzData = data;
158 g_baseFuzzSize = size;
159 g_baseFuzzPos = 0;
160
161 std::string interfaceName = GetStringFromData(STR_LEN);
162 MessageParcel dataParcel;
163 if (!WriteInterfaceToken(dataParcel)) {
164 return;
165 }
166 dataParcel.WriteString(interfaceName);
167
168 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_IFACE_RXBYTES), dataParcel);
169 }
170
GetIfaceTxBytesFuzzTest(const uint8_t * data,size_t size)171 void GetIfaceTxBytesFuzzTest(const uint8_t *data, size_t size)
172 {
173 if ((data == nullptr) || (size == 0)) {
174 return;
175 }
176 g_baseFuzzData = data;
177 g_baseFuzzSize = size;
178 g_baseFuzzPos = 0;
179
180 std::string interfaceName = GetStringFromData(STR_LEN);
181 MessageParcel dataParcel;
182 if (!WriteInterfaceToken(dataParcel)) {
183 return;
184 }
185 dataParcel.WriteString(interfaceName);
186
187 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_IFACE_TXBYTES), dataParcel);
188 }
189
GetUidRxBytesFuzzTest(const uint8_t * data,size_t size)190 void GetUidRxBytesFuzzTest(const uint8_t *data, size_t size)
191 {
192 if ((data == nullptr) || (size == 0)) {
193 return;
194 }
195 g_baseFuzzData = data;
196 g_baseFuzzSize = size;
197 g_baseFuzzPos = 0;
198
199 uint32_t uid = GetData<uint32_t>();
200 MessageParcel dataParcel;
201 if (!WriteInterfaceToken(dataParcel)) {
202 return;
203 }
204 dataParcel.WriteUint32(uid);
205
206 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_UID_RXBYTES), dataParcel);
207 }
208
GetUidTxBytesFuzzTest(const uint8_t * data,size_t size)209 void GetUidTxBytesFuzzTest(const uint8_t *data, size_t size)
210 {
211 if ((data == nullptr) || (size == 0)) {
212 return;
213 }
214 g_baseFuzzData = data;
215 g_baseFuzzSize = size;
216 g_baseFuzzPos = 0;
217
218 uint32_t uid = GetData<uint32_t>();
219 MessageParcel dataParcel;
220 if (!WriteInterfaceToken(dataParcel)) {
221 return;
222 }
223 dataParcel.WriteUint32(uid);
224
225 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_UID_TXBYTES), dataParcel);
226 }
227
GetCellularRxBytesFuzzTest(const uint8_t * data,size_t size)228 void GetCellularRxBytesFuzzTest(const uint8_t *data, size_t size)
229 {
230 if ((data == nullptr) || (size == 0)) {
231 return;
232 }
233 g_baseFuzzData = data;
234 g_baseFuzzSize = size;
235 g_baseFuzzPos = 0;
236
237 MessageParcel dataParcel;
238 if (!WriteInterfaceToken(dataParcel)) {
239 return;
240 }
241
242 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_CELLULAR_RXBYTES), dataParcel);
243 }
244
GetCellularTxBytesFuzzTest(const uint8_t * data,size_t size)245 void GetCellularTxBytesFuzzTest(const uint8_t *data, size_t size)
246 {
247 if ((data == nullptr) || (size == 0)) {
248 return;
249 }
250 g_baseFuzzData = data;
251 g_baseFuzzSize = size;
252 g_baseFuzzPos = 0;
253
254 MessageParcel dataParcel;
255 if (!WriteInterfaceToken(dataParcel)) {
256 return;
257 }
258
259 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_CELLULAR_TXBYTES), dataParcel);
260 }
261
GetAllRxBytesFuzzTest(const uint8_t * data,size_t size)262 void GetAllRxBytesFuzzTest(const uint8_t *data, size_t size)
263 {
264 if ((data == nullptr) || (size == 0)) {
265 return;
266 }
267 g_baseFuzzData = data;
268 g_baseFuzzSize = size;
269 g_baseFuzzPos = 0;
270
271 MessageParcel dataParcel;
272 if (!WriteInterfaceToken(dataParcel)) {
273 return;
274 }
275
276 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_ALL_RXBYTES), dataParcel);
277 }
278
GetAllTxBytesFuzzTest(const uint8_t * data,size_t size)279 void GetAllTxBytesFuzzTest(const uint8_t *data, size_t size)
280 {
281 if ((data == nullptr) || (size == 0)) {
282 return;
283 }
284 g_baseFuzzData = data;
285 g_baseFuzzSize = size;
286 g_baseFuzzPos = 0;
287
288 MessageParcel dataParcel;
289 if (!WriteInterfaceToken(dataParcel)) {
290 return;
291 }
292
293 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_ALL_TXBYTES), dataParcel);
294 }
295
GetIfaceStatsDetailFuzzTest(const uint8_t * data,size_t size)296 void GetIfaceStatsDetailFuzzTest(const uint8_t *data, size_t size)
297 {
298 if ((data == nullptr) || (size == 0)) {
299 return;
300 }
301 g_baseFuzzData = data;
302 g_baseFuzzSize = size;
303 g_baseFuzzPos = 0;
304
305 MessageParcel dataParcel;
306 if (!WriteInterfaceToken(dataParcel)) {
307 return;
308 }
309
310 dataParcel.WriteString(GetStringFromData(STR_LEN));
311 dataParcel.WriteUint64(GetData<uint64_t>());
312 dataParcel.WriteUint64(GetData<uint64_t>());
313
314 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_IFACE_STATS_DETAIL), dataParcel);
315 }
316
GetUidStatsDetailFuzzTest(const uint8_t * data,size_t size)317 void GetUidStatsDetailFuzzTest(const uint8_t *data, size_t size)
318 {
319 if ((data == nullptr) || (size == 0)) {
320 return;
321 }
322 g_baseFuzzData = data;
323 g_baseFuzzSize = size;
324 g_baseFuzzPos = 0;
325
326 MessageParcel dataParcel;
327 if (!WriteInterfaceToken(dataParcel)) {
328 return;
329 }
330 dataParcel.WriteString(GetStringFromData(STR_LEN));
331 dataParcel.WriteUint64(GetData<uint32_t>());
332 dataParcel.WriteUint64(GetData<uint64_t>());
333 dataParcel.WriteUint64(GetData<uint64_t>());
334
335 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_UID_STATS_DETAIL), dataParcel);
336 }
337
UpdateIfacesStatsFuzzTest(const uint8_t * data,size_t size)338 void UpdateIfacesStatsFuzzTest(const uint8_t *data, size_t size)
339 {
340 if ((data == nullptr) || (size == 0)) {
341 return;
342 }
343 g_baseFuzzData = data;
344 g_baseFuzzSize = size;
345 g_baseFuzzPos = 0;
346
347 MessageParcel dataParcel;
348 if (!WriteInterfaceToken(dataParcel)) {
349 return;
350 }
351 dataParcel.WriteString(GetStringFromData(STR_LEN));
352 dataParcel.WriteUint64(GetData<uint64_t>());
353 dataParcel.WriteUint64(GetData<uint64_t>());
354 NetStatsInfo stats;
355 stats.iface_ = GetStringFromData(STR_LEN);
356 stats.uid_ = GetData<uint32_t>();
357 stats.date_ = GetData<uint64_t>();
358 stats.rxBytes_ = GetData<uint64_t>();
359 stats.txBytes_ = GetData<uint64_t>();
360 stats.rxPackets_ = GetData<uint64_t>();
361 stats.txPackets_ = GetData<uint64_t>();
362 stats.Marshalling(dataParcel);
363
364 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_UPDATE_IFACES_STATS), dataParcel);
365 }
366
UpdateStatsDataFuzzTest(const uint8_t * data,size_t size)367 void UpdateStatsDataFuzzTest(const uint8_t *data, size_t size)
368 {
369 if ((data == nullptr) || (size == 0)) {
370 return;
371 }
372 g_baseFuzzData = data;
373 g_baseFuzzSize = size;
374 g_baseFuzzPos = 0;
375
376 MessageParcel dataParcel;
377 if (!WriteInterfaceToken(dataParcel)) {
378 return;
379 }
380
381 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_UPDATE_STATS_DATA), dataParcel);
382 }
383
ResetFactoryFuzzTest(const uint8_t * data,size_t size)384 void ResetFactoryFuzzTest(const uint8_t *data, size_t size)
385 {
386 if ((data == nullptr) || (size == 0)) {
387 return;
388 }
389 g_baseFuzzData = data;
390 g_baseFuzzSize = size;
391 g_baseFuzzPos = 0;
392
393 MessageParcel dataParcel;
394 if (!WriteInterfaceToken(dataParcel)) {
395 return;
396 }
397
398 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_NSM_RESET_FACTORY), dataParcel);
399 }
400 } // namespace NetManagerStandard
401 } // namespace OHOS
402
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)403 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
404 {
405 /* Run your code on data */
406 OHOS::NetManagerStandard::RegisterNetStatsCallbackFuzzTest(data, size);
407 OHOS::NetManagerStandard::UnregisterNetStatsCallbackFuzzTest(data, size);
408 OHOS::NetManagerStandard::GetIfaceRxBytesFuzzTest(data, size);
409 OHOS::NetManagerStandard::GetIfaceTxBytesFuzzTest(data, size);
410 OHOS::NetManagerStandard::GetUidRxBytesFuzzTest(data, size);
411 OHOS::NetManagerStandard::GetUidTxBytesFuzzTest(data, size);
412 OHOS::NetManagerStandard::GetCellularRxBytesFuzzTest(data, size);
413 OHOS::NetManagerStandard::GetCellularTxBytesFuzzTest(data, size);
414 OHOS::NetManagerStandard::GetAllRxBytesFuzzTest(data, size);
415 OHOS::NetManagerStandard::GetAllTxBytesFuzzTest(data, size);
416 OHOS::NetManagerStandard::GetIfaceStatsDetailFuzzTest(data, size);
417 OHOS::NetManagerStandard::GetUidStatsDetailFuzzTest(data, size);
418 OHOS::NetManagerStandard::UpdateIfacesStatsFuzzTest(data, size);
419 OHOS::NetManagerStandard::ResetFactoryFuzzTest(data, size);
420 return 0;
421 }