1 /*
2 * Copyright (c) 2022-2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "ethernet_client_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20 #include <iosfwd>
21 #include <memory>
22 #include <new>
23 #include <securec.h>
24 #include <string>
25
26 #include "netmanager_ext_test_security.h"
27 #include "refbase.h"
28 #include "singleton.h"
29
30 #include "dev_interface_state.h"
31 #define private public
32 #include "ethernet_client.h"
33 #include "ethernet_service.h"
34 #include "interface_configuration.h"
35 #include "interface_state_callback_stub.h"
36
37 namespace OHOS {
38 namespace NetManagerStandard {
39 namespace {
40 const uint8_t *g_baseFuzzData = nullptr;
41 static constexpr uint32_t CREATE_BOOL_TYPE_VALUE = 2;
42 size_t g_baseFuzzSize = 0;
43 size_t g_baseFuzzPos;
44 constexpr size_t IFACE_LEN = 5;
45 } // namespace
46
GetData()47 template <class T> T GetData()
48 {
49 T object{};
50 size_t objectSize = sizeof(object);
51 if (g_baseFuzzData == nullptr || objectSize > g_baseFuzzSize - g_baseFuzzPos) {
52 return object;
53 }
54 errno_t ret = memcpy_s(&object, objectSize, g_baseFuzzData + g_baseFuzzPos, objectSize);
55 if (ret != EOK) {
56 return {};
57 }
58 g_baseFuzzPos += objectSize;
59 return object;
60 }
61
62 class MonitorInterfaceStateCallback : public InterfaceStateCallbackStub {
63 public:
OnInterfaceAdded(const std::string & ifName)64 int32_t OnInterfaceAdded(const std::string &ifName) override
65 {
66 return 0;
67 }
68
OnInterfaceRemoved(const std::string & ifName)69 int32_t OnInterfaceRemoved(const std::string &ifName) override
70 {
71 return 0;
72 }
73
OnInterfaceChanged(const std::string & ifName,bool up)74 int32_t OnInterfaceChanged(const std::string &ifName, bool up) override
75 {
76 return 0;
77 }
78 };
79
GetStringFromData(int strlen)80 std::string GetStringFromData(int strlen)
81 {
82 char cstr[strlen];
83 cstr[strlen - 1] = '\0';
84 for (int i = 0; i < strlen - 1; i++) {
85 cstr[i] = GetData<char>();
86 }
87 std::string str(cstr);
88 return str;
89 }
90
91 static bool g_isInited = false;
92
Init()93 void Init()
94 {
95 if (!g_isInited) {
96 DelayedSingleton<EthernetService>::GetInstance()->Init();
97 g_isInited = true;
98 }
99 }
100
WriteInterfaceToken(MessageParcel & data)101 bool WriteInterfaceToken(MessageParcel &data)
102 {
103 if (!data.WriteInterfaceToken(EthernetServiceStub::GetDescriptor())) {
104 return false;
105 }
106 return true;
107 }
108
IsDataAndWriteVaild(const uint8_t * data,size_t size,MessageParcel & parcel)109 bool IsDataAndWriteVaild(const uint8_t *data, size_t size, MessageParcel &parcel)
110 {
111 if ((data == nullptr) || (size == 0)) {
112 return false;
113 }
114 NetManagerExtAccessToken token;
115 g_baseFuzzData = data;
116 g_baseFuzzSize = size;
117 g_baseFuzzPos = 0;
118
119 std::string iface = GetStringFromData(IFACE_LEN);
120 WriteInterfaceToken(parcel);
121 if (!parcel.WriteString(iface)) {
122 return false;
123 }
124
125 return true;
126 }
127
128
OnRemoteRequest(uint32_t code,MessageParcel & data)129 int32_t OnRemoteRequest(uint32_t code, MessageParcel &data)
130 {
131 if (!g_isInited) {
132 Init();
133 }
134
135 MessageParcel reply;
136 MessageOption option;
137 return DelayedSingleton<EthernetService>::GetInstance()->OnRemoteRequest(code, data, reply, option);
138 }
139
SetIfaceConfigFuzzTest(const uint8_t * data,size_t size)140 void SetIfaceConfigFuzzTest(const uint8_t *data, size_t size)
141 {
142 MessageParcel parcel;
143 if (!IsDataAndWriteVaild(data, size, parcel)) {
144 return;
145 }
146 auto ic = std::make_unique<InterfaceConfiguration>();
147 if (!ic->Marshalling(parcel)) {
148 return;
149 }
150 OnRemoteRequest(static_cast<uint32_t>(EthernetInterfaceCode::CMD_SET_IF_CFG), parcel);
151 }
152
GetIfaceConfigFuzzTest(const uint8_t * data,size_t size)153 void GetIfaceConfigFuzzTest(const uint8_t *data, size_t size)
154 {
155 if ((data == nullptr) || (size == 0)) {
156 return;
157 }
158 g_baseFuzzData = data;
159 g_baseFuzzSize = size;
160 g_baseFuzzPos = 0;
161 NetManagerExtAccessToken token;
162 MessageParcel parcel;
163 std::string iface = GetStringFromData(IFACE_LEN);
164 WriteInterfaceToken(parcel);
165 if (!parcel.WriteString(iface)) {
166 return;
167 }
168 OnRemoteRequest(static_cast<uint32_t>(EthernetInterfaceCode::CMD_GET_IF_CFG), parcel);
169 }
170
IsIfaceActiveFuzzTest(const uint8_t * data,size_t size)171 void IsIfaceActiveFuzzTest(const uint8_t *data, size_t size)
172 {
173 if ((data == nullptr) || (size == 0)) {
174 return;
175 }
176 g_baseFuzzData = data;
177 g_baseFuzzSize = size;
178 g_baseFuzzPos = 0;
179 NetManagerExtAccessToken token;
180 MessageParcel parcel;
181 std::string iface = GetStringFromData(IFACE_LEN);
182 WriteInterfaceToken(parcel);
183 if (!parcel.WriteString(iface)) {
184 return;
185 }
186 OnRemoteRequest(static_cast<uint32_t>(EthernetInterfaceCode::CMD_IS_ACTIVATE), parcel);
187 }
188
GetAllActiveIfacesFuzzTest(const uint8_t * data,size_t size)189 void GetAllActiveIfacesFuzzTest(const uint8_t *data, size_t size)
190 {
191 if ((data == nullptr) || (size == 0)) {
192 return;
193 }
194 NetManagerExtAccessToken token;
195 MessageParcel parcel;
196 WriteInterfaceToken(parcel);
197 OnRemoteRequest(static_cast<uint32_t>(EthernetInterfaceCode::CMD_GET_ACTIVATE_INTERFACE), parcel);
198 }
199
ResetFactoryFuzzTest(const uint8_t * data,size_t size)200 void ResetFactoryFuzzTest(const uint8_t *data, size_t size)
201 {
202 if ((data == nullptr) || (size == 0)) {
203 return;
204 }
205 NetManagerExtAccessToken token;
206 MessageParcel parcel;
207 WriteInterfaceToken(parcel);
208 OnRemoteRequest(static_cast<uint32_t>(EthernetInterfaceCode::CMD_RESET_FACTORY), parcel);
209 }
210
UnregisterIfacesStateChangedFuzzTest(const uint8_t * data,size_t size)211 void UnregisterIfacesStateChangedFuzzTest(const uint8_t *data, size_t size)
212 {
213 if ((data == nullptr) || (size == 0)) {
214 return;
215 }
216 NetManagerExtAccessToken token;
217 g_baseFuzzData = data;
218 g_baseFuzzSize = size;
219 g_baseFuzzPos = 0;
220 sptr<InterfaceStateCallback> interfaceCallback = new (std::nothrow) MonitorInterfaceStateCallback();
221 DelayedSingleton<EthernetClient>::GetInstance()->RegisterIfacesStateChanged(interfaceCallback);
222 DelayedSingleton<EthernetClient>::GetInstance()->UnregisterIfacesStateChanged(interfaceCallback);
223 }
224
OnRegisterIfacesStateChangedFuzzTest(const uint8_t * data,size_t size)225 void OnRegisterIfacesStateChangedFuzzTest(const uint8_t *data, size_t size)
226 {
227 if ((data == nullptr) || (size == 0)) {
228 return;
229 }
230 MessageParcel parcel;
231 sptr<IRemoteObject> remote;
232 parcel.WriteRemoteObject(remote);
233 OnRemoteRequest(static_cast<uint32_t>(EthernetInterfaceCode::CMD_REGISTER_INTERFACE_CB), parcel);
234 OnRemoteRequest(static_cast<uint32_t>(EthernetInterfaceCode::CMD_UNREGISTER_INTERFACE_CB), parcel);
235 }
236
SetInterfaceUpFuzzTest(const uint8_t * data,size_t size)237 void SetInterfaceUpFuzzTest(const uint8_t *data, size_t size)
238 {
239 MessageParcel parcel;
240 if (!IsDataAndWriteVaild(data, size, parcel)) {
241 return;
242 }
243 OnRemoteRequest(static_cast<uint32_t>(EthernetInterfaceCode::CMD_SET_INTERFACE_UP), parcel);
244 }
245
SetInterfaceDownFuzzTest(const uint8_t * data,size_t size)246 void SetInterfaceDownFuzzTest(const uint8_t *data, size_t size)
247 {
248 MessageParcel parcel;
249 if (!IsDataAndWriteVaild(data, size, parcel)) {
250 return;
251 }
252 OnRemoteRequest(static_cast<uint32_t>(EthernetInterfaceCode::CMD_SET_INTERFACE_DOWN), parcel);
253 }
254
GetInterfaceConfigFuzzTest(const uint8_t * data,size_t size)255 void GetInterfaceConfigFuzzTest(const uint8_t *data, size_t size)
256 {
257 MessageParcel parcel;
258 if (!IsDataAndWriteVaild(data, size, parcel)) {
259 return;
260 }
261 OnRemoteRequest(static_cast<uint32_t>(EthernetInterfaceCode::CMD_GET_INTERFACE_CONFIG), parcel);
262 }
263
SetInterfaceConfigFuzzTest(const uint8_t * data,size_t size)264 void SetInterfaceConfigFuzzTest(const uint8_t *data, size_t size)
265 {
266 if ((data == nullptr) || (size == 0)) {
267 return;
268 }
269 NetManagerExtAccessToken token;
270 g_baseFuzzData = data;
271 g_baseFuzzSize = size;
272 g_baseFuzzPos = 0;
273 MessageParcel parcel;
274 std::string randStr = GetStringFromData(IFACE_LEN);
275 WriteInterfaceToken(parcel);
276 if (!parcel.WriteString(randStr)) {
277 return;
278 }
279 if (!parcel.WriteString(randStr)) {
280 return;
281 }
282 if (!parcel.WriteString(randStr)) {
283 return;
284 }
285 if (!parcel.WriteString(randStr)) {
286 return;
287 }
288 if (!parcel.WriteInt32(GetData<int32_t>())) {
289 return;
290 }
291 if (!parcel.WriteInt32(1)) {
292 return;
293 }
294 if (!parcel.WriteString(randStr)) {
295 return;
296 }
297 OnRemoteRequest(static_cast<uint32_t>(EthernetInterfaceCode::CMD_SET_INTERFACE_CONFIG), parcel);
298 }
299
EthernetServiceCommonFuzzTest(const uint8_t * data,size_t size)300 void EthernetServiceCommonFuzzTest(const uint8_t *data, size_t size)
301 {
302 if ((data == nullptr) || (size == 0)) {
303 return;
304 }
305 g_baseFuzzData = data;
306 g_baseFuzzSize = size;
307 g_baseFuzzPos = 0;
308
309 auto ethernetServiceCommon = std::make_unique<EthernetServiceCommon>();
310
311 ethernetServiceCommon->ResetEthernetFactory();
312 }
313
EthernetManagementFuzzTest(const uint8_t * data,size_t size)314 void EthernetManagementFuzzTest(const uint8_t *data, size_t size)
315 {
316 if ((data == nullptr) || (size == 0)) {
317 return;
318 }
319 g_baseFuzzData = data;
320 g_baseFuzzSize = size;
321 g_baseFuzzPos = 0;
322
323 auto ethernetManagement = std::make_unique<EthernetManagement>();
324 EthernetDhcpCallback::DhcpResult dhcpResult;
325 ethernetManagement->UpdateDevInterfaceLinkInfo(dhcpResult);
326
327 std::string dev = GetStringFromData(IFACE_LEN);
328 bool up = GetData<uint32_t>() % CREATE_BOOL_TYPE_VALUE == 0;
329 ethernetManagement->UpdateInterfaceState(dev, up);
330
331 std::string iface = GetStringFromData(IFACE_LEN);
332 sptr<InterfaceConfiguration> cfg;
333 ethernetManagement->UpdateDevInterfaceCfg(iface, cfg);
334
335 sptr<InterfaceConfiguration> ifaceConfig;
336 ethernetManagement->GetDevInterfaceCfg(iface, ifaceConfig);
337
338 int32_t activeStatus = 0;
339 ethernetManagement->IsIfaceActive(iface, activeStatus);
340
341 std::vector<std::string> result;
342 ethernetManagement->GetAllActiveIfaces(result);
343
344 ethernetManagement->ResetFactory();
345 std::string devName = GetStringFromData(IFACE_LEN);
346 ethernetManagement->DevInterfaceAdd(devName);
347 ethernetManagement->DevInterfaceRemove(devName);
348 }
349
EthernetDhcpControllerFuzzTest(const uint8_t * data,size_t size)350 void EthernetDhcpControllerFuzzTest(const uint8_t *data, size_t size)
351 {
352 if ((data == nullptr) || (size == 0)) {
353 return;
354 }
355 g_baseFuzzData = data;
356 g_baseFuzzSize = size;
357 g_baseFuzzPos = 0;
358
359 auto ethernetDhcpController = std::make_unique<EthernetDhcpController>();
360
361 sptr<EthernetDhcpCallback> callback;
362 ethernetDhcpController->RegisterDhcpCallback(callback);
363
364 std::string iface = GetStringFromData(IFACE_LEN);
365 bool bIpv6 = GetData<uint32_t>() % CREATE_BOOL_TYPE_VALUE == 0;
366 ethernetDhcpController->StartClient(iface, bIpv6);
367
368 ethernetDhcpController->StopClient(iface, bIpv6);
369 }
370 } // namespace NetManagerStandard
371 } // namespace OHOS
372
373 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)374 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
375 {
376 /* Run your code on data */
377 OHOS::NetManagerStandard::SetIfaceConfigFuzzTest(data, size);
378 OHOS::NetManagerStandard::GetIfaceConfigFuzzTest(data, size);
379 OHOS::NetManagerStandard::IsIfaceActiveFuzzTest(data, size);
380 OHOS::NetManagerStandard::GetAllActiveIfacesFuzzTest(data, size);
381 OHOS::NetManagerStandard::ResetFactoryFuzzTest(data, size);
382 OHOS::NetManagerStandard::UnregisterIfacesStateChangedFuzzTest(data, size);
383 OHOS::NetManagerStandard::OnRegisterIfacesStateChangedFuzzTest(data, size);
384 OHOS::NetManagerStandard::SetInterfaceUpFuzzTest(data, size);
385 OHOS::NetManagerStandard::SetInterfaceDownFuzzTest(data, size);
386 OHOS::NetManagerStandard::GetInterfaceConfigFuzzTest(data, size);
387 OHOS::NetManagerStandard::SetInterfaceConfigFuzzTest(data, size);
388 OHOS::NetManagerStandard::EthernetServiceCommonFuzzTest(data, size);
389 OHOS::NetManagerStandard::EthernetManagementFuzzTest(data, size);
390 OHOS::NetManagerStandard::EthernetDhcpControllerFuzzTest(data, size);
391 return 0;
392 }
393