1 /*
2  * Copyright (c) 2023 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "data_collect_manager_fuzzer.h"
17 
18 #include <string>
19 
20 #include "data_collect_manager_callback_service.h"
21 #include "data_collect_manager_service.h"
22 #include "security_guard_log.h"
23 
24 
25 namespace OHOS::Security::SecurityGuard {
26 DataCollectManagerService g_service(DATA_COLLECT_MANAGER_SA_ID, true);
27 constexpr int32_t REMAINDER_VALUE = 8;
28 constexpr int32_t CMD_DATA_COLLECT_VALUE = 0;
29 constexpr int32_t CMD_DATA_REQUEST_VALUE = 1;
30 constexpr int32_t CMD_DATA_SUBSCRIBE = 2;
31 constexpr int32_t CMD_DATA_UNSUBSCRIBE_VALUE = 3;
32 constexpr int32_t CMD_SECURITY_EVENT_QUERY_VALUE = 4;
33 constexpr int32_t CMD_SECURITY_COLLECTOR_START = 5;
34 constexpr int32_t CMD_SECURITY_COLLECTOR_STOP = 6;
35 constexpr int32_t CMD_SECURITY_CONFIG_UPDATE = 7;
36 void OnRemoteCollectRequest(const uint8_t* data, size_t size, MessageParcel* datas,
37     MessageParcel* reply, MessageOption* option);
38 void OnRemoteRequestRequest(const uint8_t* data, size_t size, MessageParcel* datas,
39     MessageParcel* reply, MessageOption* option);
40 void OnRemoteSubscribeRequest(const uint8_t* data, size_t size, MessageParcel* datas,
41     MessageParcel* reply, MessageOption* option);
42 void OnRemoteUnsubscribeRequest(const uint8_t* data, size_t size, MessageParcel* datas,
43     MessageParcel* reply, MessageOption* option);
44 void OnRemoteSecurityEventQuery(const uint8_t* data, size_t size, MessageParcel* datas,
45     MessageParcel* reply, MessageOption* option);
46 void OnRemoteStart(const uint8_t* data, size_t size, MessageParcel* datas,
47     MessageParcel* reply, MessageOption* option);
48 void OnRemoteStop(const uint8_t* data, size_t size, MessageParcel* datas,
49     MessageParcel* reply, MessageOption* option);
50 void OnRemoteConfigUpdate(const uint8_t* data, size_t size, MessageParcel* datas,
51     MessageParcel* reply, MessageOption* option);
OnRemoteRequestFuzzTest(const uint8_t * data,size_t size)52 void OnRemoteRequestFuzzTest(const uint8_t* data, size_t size)
53 {
54     MessageParcel datas;
55     MessageParcel reply;
56     MessageOption option;
57     datas.WriteInterfaceToken(IDataCollectManager::GetDescriptor());
58     if (size % REMAINDER_VALUE == CMD_DATA_COLLECT_VALUE) {
59         // handle data collect cmd
60         OnRemoteCollectRequest(data, size, &datas, &reply, &option);
61         return;
62     } else if (size % REMAINDER_VALUE == CMD_DATA_REQUEST_VALUE) {
63         // handle data request cmd
64         OnRemoteRequestRequest(data, size, &datas, &reply, &option);
65         return;
66     } else if (size % REMAINDER_VALUE == CMD_DATA_SUBSCRIBE) {
67         // handle data subscribe cmd
68         OnRemoteSubscribeRequest(data, size, &datas, &reply, &option);
69         return;
70     } else if (size % REMAINDER_VALUE == CMD_DATA_UNSUBSCRIBE_VALUE) {
71         // handle data unsubscribe cmd
72         OnRemoteUnsubscribeRequest(data, size, &datas, &reply, &option);
73         return;
74     } else if (size % REMAINDER_VALUE == CMD_SECURITY_EVENT_QUERY_VALUE) {
75         // handle security event query cmd
76         OnRemoteSecurityEventQuery(data, size, &datas, &reply, &option);
77         return;
78     } else if (size % REMAINDER_VALUE == CMD_SECURITY_COLLECTOR_START) {
79         // handle collector start cmd
80         OnRemoteStart(data, size, &datas, &reply, &option);
81         return;
82     } else if (size % REMAINDER_VALUE == CMD_SECURITY_COLLECTOR_STOP) {
83         // handle collector stop cmd
84         OnRemoteStop(data, size, &datas, &reply, &option);
85         return;
86     } else if (size % REMAINDER_VALUE == CMD_SECURITY_CONFIG_UPDATE) {
87         // handle config update cmd
88         OnRemoteConfigUpdate(data, size, &datas, &reply, &option);
89         return;
90     }
91 }
92 
OnRemoteCollectRequest(const uint8_t * data,size_t size,MessageParcel * datas,MessageParcel * reply,MessageOption * option)93 void OnRemoteCollectRequest(const uint8_t* data, size_t size, MessageParcel* datas,
94     MessageParcel* reply, MessageOption* option)
95 {
96     int64_t eventId = static_cast<int64_t>(size);
97     std::string version(reinterpret_cast<const char *>(data), size);
98     std::string time(reinterpret_cast<const char *>(data), size);
99     std::string content(reinterpret_cast<const char *>(data), size);
100     datas->WriteInt64(eventId);
101     datas->WriteString(version);
102     datas->WriteString(time);
103     datas->WriteString(content);
104     g_service.OnRemoteRequest(DataCollectManagerStub::CMD_DATA_COLLECT, *datas, *reply, *option);
105 }
106 
OnRemoteRequestRequest(const uint8_t * data,size_t size,MessageParcel * datas,MessageParcel * reply,MessageOption * option)107 void OnRemoteRequestRequest(const uint8_t* data, size_t size, MessageParcel* datas,
108     MessageParcel* reply, MessageOption* option)
109 {
110     std::string deviceId(reinterpret_cast<const char *>(data), size);
111     std::string conditions(reinterpret_cast<const char *>(data), size);
112     datas->WriteString(deviceId);
113     datas->WriteString(conditions);
114     RequestRiskDataCallback func = [] (std::string &devId, std::string &riskData, uint32_t status,
115         const std::string &errMsg) -> int32_t {
116         SGLOGI("DataCollectManagerCallbackService called");
117         return 0;
118     };
119     sptr<IRemoteObject> callback = new (std::nothrow) DataCollectManagerCallbackService(func);
120     datas->WriteRemoteObject(callback);
121     g_service.OnRemoteRequest(DataCollectManagerStub::CMD_DATA_REQUEST, *datas, *reply, *option);
122 }
123 
OnRemoteSubscribeRequest(const uint8_t * data,size_t size,MessageParcel * datas,MessageParcel * reply,MessageOption * option)124 void OnRemoteSubscribeRequest(const uint8_t* data, size_t size, MessageParcel* datas,
125     MessageParcel* reply, MessageOption* option)
126 {
127     int64_t eventId = static_cast<int64_t>(size);
128     std::string version(reinterpret_cast<const char *>(data), size);
129     std::string content(reinterpret_cast<const char *>(data), size);
130     std::string extra(reinterpret_cast<const char *>(data), size);
131     int64_t duration = static_cast<int64_t>(size);
132     SecurityCollector::Event event;
133     event.eventId = eventId;
134     event.version = version;
135     event.content = content;
136     event.extra = extra;
137     SecurityCollector::SecurityCollectorSubscribeInfo subscriberInfo{event, duration, true};
138     RequestRiskDataCallback func = [] (std::string &devId, std::string &riskData, uint32_t status,
139         const std::string &errMsg) -> int32_t {
140         SGLOGI("DataCollectManagerCallbackService called");
141         return 0;
142     };
143     sptr<IRemoteObject> callback = new (std::nothrow) DataCollectManagerCallbackService(func);
144     datas->WriteRemoteObject(callback);
145     g_service.OnRemoteRequest(DataCollectManagerStub::CMD_DATA_SUBSCRIBE, *datas, *reply, *option);
146 }
147 
OnRemoteUnsubscribeRequest(const uint8_t * data,size_t size,MessageParcel * datas,MessageParcel * reply,MessageOption * option)148 void OnRemoteUnsubscribeRequest(const uint8_t* data, size_t size, MessageParcel* datas,
149     MessageParcel* reply, MessageOption* option)
150 {
151     RequestRiskDataCallback func = [] (std::string &devId, std::string &riskData, uint32_t status,
152         const std::string &errMsg) -> int32_t {
153         SGLOGI("DataCollectManagerCallbackService called");
154         return 0;
155     };
156     sptr<IRemoteObject> callback = new (std::nothrow) DataCollectManagerCallbackService(func);
157     datas->WriteRemoteObject(callback);
158     g_service.OnRemoteRequest(DataCollectManagerStub::CMD_DATA_UNSUBSCRIBE, *datas, *reply, *option);
159 }
160 
OnRemoteSecurityEventQuery(const uint8_t * data,size_t size,MessageParcel * datas,MessageParcel * reply,MessageOption * option)161 void OnRemoteSecurityEventQuery(const uint8_t* data, size_t size, MessageParcel* datas,
162     MessageParcel* reply, MessageOption* option)
163 {
164     uint32_t rulerSize = size >= MAX_QUERY_EVENT_SIZE ? MAX_QUERY_EVENT_SIZE : static_cast<uint32_t>(size);
165     datas->WriteUint32(rulerSize);
166     for (uint32_t i = 0; i < rulerSize; i++) {
167         int64_t eventId = static_cast<int64_t>(size);
168         std::string beginTime(reinterpret_cast<const char *>(data), size);
169         std::string endTime(reinterpret_cast<const char *>(data), size);
170         std::string param(reinterpret_cast<const char *>(data), size);
171         SecurityCollector::SecurityEventRuler ruler =
172             SecurityCollector::SecurityEventRuler(eventId, beginTime, endTime, param);
173         datas->WriteParcelable(&ruler);
174     }
175     RequestRiskDataCallback func = [] (std::string &devId, std::string &riskData, uint32_t status,
176         const std::string &errMsg) -> int32_t {
177         SGLOGI("DataCollectManagerCallbackService called");
178         return 0;
179     };
180     sptr<IRemoteObject> callback = new (std::nothrow) DataCollectManagerCallbackService(func);
181     datas->WriteRemoteObject(callback);
182     g_service.OnRemoteRequest(DataCollectManagerStub::CMD_SECURITY_EVENT_QUERY, *datas, *reply, *option);
183 }
184 
OnRemoteStart(const uint8_t * data,size_t size,MessageParcel * datas,MessageParcel * reply,MessageOption * option)185 void OnRemoteStart(const uint8_t* data, size_t size, MessageParcel* datas,
186     MessageParcel* reply, MessageOption* option)
187 {
188     int64_t eventId = static_cast<int64_t>(size);
189     std::string version(reinterpret_cast<const char *>(data), size);
190     std::string content(reinterpret_cast<const char *>(data), size);
191     std::string extra(reinterpret_cast<const char *>(data), size);
192     int64_t duration = static_cast<int64_t>(size);
193     SecurityCollector::Event event;
194     event.eventId = eventId;
195     event.version = version;
196     event.content = content;
197     event.extra = extra;
198     SecurityCollector::SecurityCollectorSubscribeInfo subscriberInfo{event, duration, true};
199     RequestRiskDataCallback func = [] (std::string &devId, std::string &riskData, uint32_t status,
200         const std::string &errMsg) -> int32_t {
201         SGLOGI("DataCollectManagerCallbackService called");
202         return 0;
203     };
204     sptr<IRemoteObject> callback = new (std::nothrow) DataCollectManagerCallbackService(func);
205     datas->WriteRemoteObject(callback);
206     g_service.OnRemoteRequest(DataCollectManagerStub::CMD_SECURITY_COLLECTOR_START, *datas, *reply, *option);
207 }
208 
OnRemoteStop(const uint8_t * data,size_t size,MessageParcel * datas,MessageParcel * reply,MessageOption * option)209 void OnRemoteStop(const uint8_t* data, size_t size, MessageParcel* datas,
210     MessageParcel* reply, MessageOption* option)
211 {
212     int64_t eventId = static_cast<int64_t>(size);
213     std::string version(reinterpret_cast<const char *>(data), size);
214     std::string content(reinterpret_cast<const char *>(data), size);
215     std::string extra(reinterpret_cast<const char *>(data), size);
216     int64_t duration = static_cast<int64_t>(size);
217     SecurityCollector::Event event;
218     event.eventId = eventId;
219     event.version = version;
220     event.content = content;
221     event.extra = extra;
222     SecurityCollector::SecurityCollectorSubscribeInfo subscriberInfo{event, duration, true};
223     RequestRiskDataCallback func = [] (std::string &devId, std::string &riskData, uint32_t status,
224         const std::string &errMsg) -> int32_t {
225         SGLOGI("DataCollectManagerCallbackService called");
226         return 0;
227     };
228     sptr<IRemoteObject> callback = new (std::nothrow) DataCollectManagerCallbackService(func);
229     datas->WriteRemoteObject(callback);
230     g_service.OnRemoteRequest(DataCollectManagerStub::CMD_SECURITY_COLLECTOR_STOP, *datas, *reply, *option);
231 }
232 
OnRemoteConfigUpdate(const uint8_t * data,size_t size,MessageParcel * datas,MessageParcel * reply,MessageOption * option)233 void OnRemoteConfigUpdate(const uint8_t* data, size_t size, MessageParcel* datas,
234     MessageParcel* reply, MessageOption* option)
235 {
236     int32_t fd = static_cast<int32_t>(size);
237     std::string fileName(reinterpret_cast<const char *>(data), size);
238     datas->WriteFileDescriptor(fd);
239     datas->WriteString(fileName);
240     g_service.OnRemoteRequest(DataCollectManagerStub::CMD_SECURITY_CONFIG_UPDATE, *datas, *reply, *option);
241 }
242 }  // namespace OHOS::Security::SecurityGuard
243 
244 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)245 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
246 {
247     /* Run your code on date */
248     OHOS::Security::SecurityGuard::OnRemoteRequestFuzzTest(data, size);
249     return 0;
250 }
251