1 /*
2 * Copyright (c) 2023-2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "vpnclient_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20 #include <securec.h>
21
22 #include "i_vpn_event_callback.h"
23 #include "netmanager_ext_test_security.h"
24 #include "networkvpn_service.h"
25 #include "refbase.h"
26
27 namespace OHOS {
28 namespace NetManagerStandard {
29 namespace {
30
31 constexpr size_t STR_LEN = 16;
32
33 size_t g_baseFuzzPos = 0;
34 size_t g_baseFuzzSize = 0;
35 const uint8_t *g_baseFuzzData = nullptr;
36 } // namespace
37
InitGlobalData(const uint8_t * data,size_t size)38 bool InitGlobalData(const uint8_t *data, size_t size)
39 {
40 if (data == nullptr || size == 0) {
41 return false;
42 }
43 g_baseFuzzPos = 0;
44 g_baseFuzzSize = size;
45 g_baseFuzzData = data;
46 return true;
47 }
48
GetData()49 template <class T> T GetData()
50 {
51 T object{};
52 size_t objectSize = sizeof(object);
53 if (g_baseFuzzData == nullptr || objectSize > g_baseFuzzSize - g_baseFuzzPos) {
54 return object;
55 }
56 errno_t ret = memcpy_s(&object, objectSize, g_baseFuzzData + g_baseFuzzPos, objectSize);
57 if (ret != EOK) {
58 return {};
59 }
60 g_baseFuzzPos += objectSize;
61 return object;
62 }
63
GetStringData()64 std::string GetStringData()
65 {
66 char cstr[STR_LEN] = {0};
67 for (uint32_t i = 0; i < STR_LEN - 1; i++) {
68 cstr[i] = GetData<char>();
69 }
70 return std::string(cstr);
71 }
72
GetAddressData()73 INetAddr GetAddressData()
74 {
75 INetAddr netAddr;
76 netAddr.type_ = GetData<uint8_t>();
77 netAddr.family_ = GetData<uint8_t>();
78 netAddr.prefixlen_ = GetData<uint8_t>();
79 netAddr.address_ = GetStringData();
80 netAddr.netMask_ = GetStringData();
81 netAddr.hostName_ = GetStringData();
82 netAddr.port_ = GetData<uint8_t>();
83 return netAddr;
84 }
85
GetRouteData()86 Route GetRouteData()
87 {
88 Route route;
89 route.iface_ = GetStringData();
90 route.destination_ = GetAddressData();
91 route.gateway_ = GetAddressData();
92 route.mtu_ = GetData<int32_t>();
93 route.isHost_ = GetData<bool>();
94 route.hasGateway_ = GetData<bool>();
95 route.isDefaultRoute_ = GetData<bool>();
96 return route;
97 }
98
99 class VpnEventCallbackTest : public IRemoteStub<IVpnEventCallback> {
100 public:
OnVpnStateChanged(const bool & isConnected)101 void OnVpnStateChanged(const bool &isConnected) override{};
OnVpnMultiUserSetUp()102 void OnVpnMultiUserSetUp() override{};
103 };
104
OnRemoteRequest(INetworkVpnService::MessageCode code,MessageParcel & data)105 __attribute__((no_sanitize("cfi"))) int32_t OnRemoteRequest(INetworkVpnService::MessageCode code, MessageParcel &data)
106 {
107 MessageParcel reply;
108 MessageOption option;
109 return NetworkVpnService::GetInstance().OnRemoteRequest(static_cast<uint32_t>(code), data, reply, option);
110 }
111
PrepareFuzzTest(const uint8_t * data,size_t size)112 void PrepareFuzzTest(const uint8_t *data, size_t size)
113 {
114 NetManagerExtAccessToken token;
115 MessageParcel dataParcel;
116 if (!dataParcel.WriteInterfaceToken(NetworkVpnServiceStub::GetDescriptor())) {
117 return;
118 }
119 OnRemoteRequest(INetworkVpnService::MessageCode::CMD_PREPARE, dataParcel);
120 }
121
ProtectFuzzTest(const uint8_t * data,size_t size)122 void ProtectFuzzTest(const uint8_t *data, size_t size)
123 {
124 NetManagerExtAccessToken token;
125 MessageParcel dataParcel;
126 if (!dataParcel.WriteInterfaceToken(NetworkVpnServiceStub::GetDescriptor())) {
127 return;
128 }
129 OnRemoteRequest(INetworkVpnService::MessageCode::CMD_PROTECT, dataParcel);
130 }
131
SetUpVpnFuzzTest(const uint8_t * data,size_t size)132 void SetUpVpnFuzzTest(const uint8_t *data, size_t size)
133 {
134 if (!InitGlobalData(data, size)) {
135 return;
136 }
137
138 NetManagerExtAccessToken token;
139 MessageParcel dataParcel;
140 if (!dataParcel.WriteInterfaceToken(NetworkVpnServiceStub::GetDescriptor())) {
141 return;
142 }
143 sptr<VpnConfig> config = new (std::nothrow) VpnConfig();
144 config->addresses_.emplace_back(GetAddressData());
145 config->routes_.emplace_back(GetRouteData());
146 config->mtu_ = GetData<int32_t>();
147 config->isAcceptIPv4_ = GetData<bool>();
148 config->isAcceptIPv6_ = GetData<bool>();
149 config->isLegacy_ = GetData<bool>();
150 config->isMetered_ = GetData<bool>();
151 config->isBlocking_ = GetData<bool>();
152 config->dnsAddresses_.emplace_back(GetStringData());
153 config->searchDomains_.emplace_back(GetStringData());
154 config->acceptedApplications_.emplace_back(GetStringData());
155 config->acceptedApplications_.emplace_back(GetStringData());
156 if (!config->Marshalling(dataParcel)) {
157 return;
158 }
159 OnRemoteRequest(INetworkVpnService::MessageCode::CMD_START_VPN, dataParcel);
160 }
161
DestroyVpnFuzzTest(const uint8_t * data,size_t size)162 void DestroyVpnFuzzTest(const uint8_t *data, size_t size)
163 {
164 NetManagerExtAccessToken token;
165 MessageParcel dataParcel;
166 if (!dataParcel.WriteInterfaceToken(NetworkVpnServiceStub::GetDescriptor())) {
167 return;
168 }
169 OnRemoteRequest(INetworkVpnService::MessageCode::CMD_STOP_VPN, dataParcel);
170 }
171
RegisterVpnEventFuzzTest(const uint8_t * data,size_t size)172 void RegisterVpnEventFuzzTest(const uint8_t *data, size_t size)
173 {
174 NetManagerExtAccessToken token;
175 MessageParcel dataParcel;
176 if (!dataParcel.WriteInterfaceToken(NetworkVpnServiceStub::GetDescriptor())) {
177 return;
178 }
179
180 sptr<IVpnEventCallback> callback = new (std::nothrow) VpnEventCallbackTest();
181 if (callback == nullptr || !dataParcel.WriteRemoteObject(callback->AsObject().GetRefPtr())) {
182 return;
183 }
184 OnRemoteRequest(INetworkVpnService::MessageCode::CMD_REGISTER_EVENT_CALLBACK, dataParcel);
185 }
186
UnregisterVpnEventFuzzTest(const uint8_t * data,size_t size)187 void UnregisterVpnEventFuzzTest(const uint8_t *data, size_t size)
188 {
189 NetManagerExtAccessToken token;
190 MessageParcel dataParcel;
191 if (!dataParcel.WriteInterfaceToken(NetworkVpnServiceStub::GetDescriptor())) {
192 return;
193 }
194
195 sptr<IVpnEventCallback> callback = new (std::nothrow) VpnEventCallbackTest();
196 if (callback == nullptr || !dataParcel.WriteRemoteObject(callback->AsObject().GetRefPtr())) {
197 return;
198 }
199 OnRemoteRequest(INetworkVpnService::MessageCode::CMD_UNREGISTER_EVENT_CALLBACK, dataParcel);
200 }
201 } // namespace NetManagerStandard
202 } // namespace OHOS
203
204 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)205 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
206 {
207 /* Run your code on data */
208 OHOS::NetManagerStandard::PrepareFuzzTest(data, size);
209 OHOS::NetManagerStandard::ProtectFuzzTest(data, size);
210 OHOS::NetManagerStandard::SetUpVpnFuzzTest(data, size);
211 OHOS::NetManagerStandard::DestroyVpnFuzzTest(data, size);
212 OHOS::NetManagerStandard::RegisterVpnEventFuzzTest(data, size);
213 OHOS::NetManagerStandard::UnregisterVpnEventFuzzTest(data, size);
214 return 0;
215 }
216