1 /*
2 * Copyright (c) 2022-2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <ctime>
17 #include <thread>
18 #include <vector>
19
20 #include <securec.h>
21
22 #include "data_flow_statistics.h"
23 #include "i_net_stats_service.h"
24 #include "net_mgr_log_wrapper.h"
25 #include "net_stats_client.h"
26 #include "net_stats_constants.h"
27 #define private public
28 #include "net_stats_service.h"
29 #include "net_stats_service_stub.h"
30
31 namespace OHOS {
32 namespace NetManagerStandard {
33 namespace {
34 const uint8_t *g_baseFuzzData = nullptr;
35 size_t g_baseFuzzSize = 0;
36 size_t g_baseFuzzPos;
37 constexpr size_t STR_LEN = 10;
38 } // namespace
39
NetStatsGetData()40 template <class T> T NetStatsGetData()
41 {
42 T object{};
43 size_t netStatsSize = sizeof(object);
44 if (g_baseFuzzData == nullptr || netStatsSize > g_baseFuzzSize - g_baseFuzzPos) {
45 return object;
46 }
47 errno_t ret = memcpy_s(&object, netStatsSize, g_baseFuzzData + g_baseFuzzPos, netStatsSize);
48 if (ret != EOK) {
49 return {};
50 }
51 g_baseFuzzPos += netStatsSize;
52 return object;
53 }
54
NetStatsGetString(int strlen)55 std::string NetStatsGetString(int strlen)
56 {
57 char cstr[strlen];
58 cstr[strlen - 1] = '\0';
59 for (int i = 0; i < strlen - 1; i++) {
60 cstr[i] = NetStatsGetData<char>();
61 }
62 std::string str(cstr);
63 return str;
64 }
65
66 class INetStatsCallbackTest : public IRemoteStub<INetStatsCallback> {
67 public:
NetIfaceStatsChanged(const std::string & iface)68 int32_t NetIfaceStatsChanged(const std::string &iface)
69 {
70 return 0;
71 }
72
NetUidStatsChanged(const std::string & iface,uint32_t uid)73 int32_t NetUidStatsChanged(const std::string &iface, uint32_t uid)
74 {
75 return 0;
76 }
77 };
78
79 static bool g_isInited = false;
80
Init()81 void Init()
82 {
83 if (!g_isInited) {
84 DelayedSingleton<NetStatsService>::GetInstance()->Init();
85 g_isInited = false;
86 } else {
87 g_isInited = true;
88 }
89 }
90
OnRemoteRequest(uint32_t code,MessageParcel & data)91 __attribute__((no_sanitize("cfi"))) int32_t OnRemoteRequest(uint32_t code, MessageParcel &data)
92 {
93 if (!g_isInited) {
94 Init();
95 }
96
97 MessageParcel reply;
98 MessageOption option;
99
100 int32_t ret = DelayedSingleton<NetStatsService>::GetInstance()->OnRemoteRequest(code, data, reply, option);
101 return ret;
102 }
103
WriteInterfaceToken(MessageParcel & data)104 bool WriteInterfaceToken(MessageParcel &data)
105 {
106 if (!data.WriteInterfaceToken(NetStatsServiceStub::GetDescriptor())) {
107 return false;
108 }
109 return true;
110 }
111
CheckParamVaild(MessageParcel & dataParcel,const uint8_t * data,size_t size)112 void CheckParamVaild(MessageParcel &dataParcel, const uint8_t *data, size_t size)
113 {
114 if ((data == nullptr) || (size == 0)) {
115 return;
116 }
117 g_baseFuzzData = data;
118 g_baseFuzzSize = size;
119 g_baseFuzzPos = 0;
120
121 if (!WriteInterfaceToken(dataParcel)) {
122 return;
123 }
124
125 return;
126 }
127
RegisterNetStatsCallbackFuzzTest(const uint8_t * data,size_t size)128 void RegisterNetStatsCallbackFuzzTest(const uint8_t *data, size_t size)
129 {
130 if ((data == nullptr) || (size == 0)) {
131 return;
132 }
133
134 sptr<INetStatsCallbackTest> callback = new (std::nothrow) INetStatsCallbackTest();
135 if (callback == nullptr) {
136 return;
137 }
138
139 MessageParcel dataParcel;
140 if (!WriteInterfaceToken(dataParcel)) {
141 return;
142 }
143 dataParcel.WriteRemoteObject(callback->AsObject().GetRefPtr());
144
145 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_NSM_REGISTER_NET_STATS_CALLBACK), dataParcel);
146 }
147
UnregisterNetStatsCallbackFuzzTest(const uint8_t * data,size_t size)148 void UnregisterNetStatsCallbackFuzzTest(const uint8_t *data, size_t size)
149 {
150 if ((data == nullptr) || (size == 0)) {
151 return;
152 }
153
154 sptr<INetStatsCallbackTest> callback = new (std::nothrow) INetStatsCallbackTest();
155 if (callback == nullptr) {
156 return;
157 }
158
159 MessageParcel dataParcel;
160 if (!WriteInterfaceToken(dataParcel)) {
161 return;
162 }
163 dataParcel.WriteRemoteObject(callback->AsObject().GetRefPtr());
164
165 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_NSM_UNREGISTER_NET_STATS_CALLBACK), dataParcel);
166 }
167
GetIfaceRxBytesFuzzTest(const uint8_t * data,size_t size)168 __attribute__((no_sanitize("cfi"))) void GetIfaceRxBytesFuzzTest(const uint8_t *data, size_t size)
169 {
170 MessageParcel dataParcel;
171 CheckParamVaild(dataParcel, data, size);
172 std::string interfaceName = NetStatsGetString(STR_LEN);
173 dataParcel.WriteString(interfaceName);
174
175 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_IFACE_RXBYTES), dataParcel);
176 }
177
GetIfaceTxBytesFuzzTest(const uint8_t * data,size_t size)178 void GetIfaceTxBytesFuzzTest(const uint8_t *data, size_t size)
179 {
180 MessageParcel dataParcel;
181 CheckParamVaild(dataParcel, data, size);
182 std::string interfaceName = NetStatsGetString(STR_LEN);
183 dataParcel.WriteString(interfaceName);
184
185 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_IFACE_TXBYTES), dataParcel);
186 }
187
GetUidRxBytesFuzzTest(const uint8_t * data,size_t size)188 void GetUidRxBytesFuzzTest(const uint8_t *data, size_t size)
189 {
190 MessageParcel dataParcel;
191 CheckParamVaild(dataParcel, data, size);
192 uint32_t uid = NetStatsGetData<uint32_t>();
193 dataParcel.WriteUint32(uid);
194
195 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_UID_RXBYTES), dataParcel);
196 }
197
GetUidTxBytesFuzzTest(const uint8_t * data,size_t size)198 void GetUidTxBytesFuzzTest(const uint8_t *data, size_t size)
199 {
200 MessageParcel dataParcel;
201 CheckParamVaild(dataParcel, data, size);
202 uint32_t uid = NetStatsGetData<uint32_t>();
203 dataParcel.WriteUint32(uid);
204
205 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_UID_TXBYTES), dataParcel);
206 }
207
GetCellularRxBytesFuzzTest(const uint8_t * data,size_t size)208 void GetCellularRxBytesFuzzTest(const uint8_t *data, size_t size)
209 {
210 MessageParcel dataParcel;
211 CheckParamVaild(dataParcel, data, size);
212 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_CELLULAR_RXBYTES), dataParcel);
213 }
214
GetCellularTxBytesFuzzTest(const uint8_t * data,size_t size)215 void GetCellularTxBytesFuzzTest(const uint8_t *data, size_t size)
216 {
217 MessageParcel dataParcel;
218 CheckParamVaild(dataParcel, data, size);
219 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_CELLULAR_TXBYTES), dataParcel);
220 }
221
GetAllRxBytesFuzzTest(const uint8_t * data,size_t size)222 void GetAllRxBytesFuzzTest(const uint8_t *data, size_t size)
223 {
224 MessageParcel dataParcel;
225 CheckParamVaild(dataParcel, data, size);
226 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_ALL_RXBYTES), dataParcel);
227 }
228
GetAllTxBytesFuzzTest(const uint8_t * data,size_t size)229 void GetAllTxBytesFuzzTest(const uint8_t *data, size_t size)
230 {
231 MessageParcel dataParcel;
232 CheckParamVaild(dataParcel, data, size);
233 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_ALL_TXBYTES), dataParcel);
234 }
235
GetIfaceStatsDetailFuzzTest(const uint8_t * data,size_t size)236 void GetIfaceStatsDetailFuzzTest(const uint8_t *data, size_t size)
237 {
238 MessageParcel dataParcel;
239 CheckParamVaild(dataParcel, data, size);
240 dataParcel.WriteString(NetStatsGetString(STR_LEN));
241 dataParcel.WriteUint64(NetStatsGetData<uint64_t>());
242 dataParcel.WriteUint64(NetStatsGetData<uint64_t>());
243
244 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_IFACE_STATS_DETAIL), dataParcel);
245 }
246
GetUidStatsDetailFuzzTest(const uint8_t * data,size_t size)247 void GetUidStatsDetailFuzzTest(const uint8_t *data, size_t size)
248 {
249 MessageParcel dataParcel;
250 CheckParamVaild(dataParcel, data, size);
251 dataParcel.WriteString(NetStatsGetString(STR_LEN));
252 dataParcel.WriteUint64(NetStatsGetData<uint32_t>());
253 dataParcel.WriteUint64(NetStatsGetData<uint64_t>());
254 dataParcel.WriteUint64(NetStatsGetData<uint64_t>());
255
256 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_UID_STATS_DETAIL), dataParcel);
257 }
258
UpdateIfacesStatsFuzzTest(const uint8_t * data,size_t size)259 void UpdateIfacesStatsFuzzTest(const uint8_t *data, size_t size)
260 {
261 MessageParcel dataParcel;
262 CheckParamVaild(dataParcel, data, size);
263 dataParcel.WriteString(NetStatsGetString(STR_LEN));
264 dataParcel.WriteUint64(NetStatsGetData<uint64_t>());
265 dataParcel.WriteUint64(NetStatsGetData<uint64_t>());
266 NetStatsInfo stats;
267 stats.iface_ = NetStatsGetString(STR_LEN);
268 stats.uid_ = NetStatsGetData<uint32_t>();
269 stats.date_ = NetStatsGetData<uint64_t>();
270 stats.rxBytes_ = NetStatsGetData<uint64_t>();
271 stats.txBytes_ = NetStatsGetData<uint64_t>();
272 stats.rxPackets_ = NetStatsGetData<uint64_t>();
273 stats.txPackets_ = NetStatsGetData<uint64_t>();
274 stats.Marshalling(dataParcel);
275
276 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_UPDATE_IFACES_STATS), dataParcel);
277 }
278
UpdateStatsDataFuzzTest(const uint8_t * data,size_t size)279 void UpdateStatsDataFuzzTest(const uint8_t *data, size_t size)
280 {
281 MessageParcel dataParcel;
282 CheckParamVaild(dataParcel, data, size);
283 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_UPDATE_STATS_DATA), dataParcel);
284 }
285
ResetFactoryFuzzTest(const uint8_t * data,size_t size)286 void ResetFactoryFuzzTest(const uint8_t *data, size_t size)
287 {
288 MessageParcel dataParcel;
289 CheckParamVaild(dataParcel, data, size);
290 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_NSM_RESET_FACTORY), dataParcel);
291 }
292
GetCookieRxBytesFuzzTest(const uint8_t * data,size_t size)293 void GetCookieRxBytesFuzzTest(const uint8_t *data, size_t size)
294 {
295 MessageParcel dataParcel;
296 CheckParamVaild(dataParcel, data, size);
297 uint64_t cookie = NetStatsGetData<uint64_t>();
298 dataParcel.WriteUint32(cookie);
299
300 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_COOKIE_RXBYTES), dataParcel);
301 }
302
GetCookieTxBytesFuzzTest(const uint8_t * data,size_t size)303 void GetCookieTxBytesFuzzTest(const uint8_t *data, size_t size)
304 {
305 MessageParcel dataParcel;
306 CheckParamVaild(dataParcel, data, size);
307 uint64_t cookie = NetStatsGetData<uint64_t>();
308 dataParcel.WriteUint32(cookie);
309
310 OnRemoteRequest(static_cast<uint32_t>(StatsInterfaceCode::CMD_GET_COOKIE_TXBYTES), dataParcel);
311 }
312 } // namespace NetManagerStandard
313 } // namespace OHOS
314
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)315 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
316 {
317 /* Run your code on data */
318 OHOS::NetManagerStandard::RegisterNetStatsCallbackFuzzTest(data, size);
319 OHOS::NetManagerStandard::UnregisterNetStatsCallbackFuzzTest(data, size);
320 OHOS::NetManagerStandard::GetIfaceRxBytesFuzzTest(data, size);
321 OHOS::NetManagerStandard::GetIfaceTxBytesFuzzTest(data, size);
322 OHOS::NetManagerStandard::GetUidRxBytesFuzzTest(data, size);
323 OHOS::NetManagerStandard::GetUidTxBytesFuzzTest(data, size);
324 OHOS::NetManagerStandard::GetCellularRxBytesFuzzTest(data, size);
325 OHOS::NetManagerStandard::GetCellularTxBytesFuzzTest(data, size);
326 OHOS::NetManagerStandard::GetAllRxBytesFuzzTest(data, size);
327 OHOS::NetManagerStandard::GetAllTxBytesFuzzTest(data, size);
328 OHOS::NetManagerStandard::GetIfaceStatsDetailFuzzTest(data, size);
329 OHOS::NetManagerStandard::GetUidStatsDetailFuzzTest(data, size);
330 OHOS::NetManagerStandard::UpdateIfacesStatsFuzzTest(data, size);
331 OHOS::NetManagerStandard::ResetFactoryFuzzTest(data, size);
332 OHOS::NetManagerStandard::GetCookieRxBytesFuzzTest(data, size);
333 OHOS::NetManagerStandard::GetCookieTxBytesFuzzTest(data, size);
334 return 0;
335 }
336