From 48947f24371dc73216871a2c8f569a9ce07e713a Mon Sep 17 00:00:00 2001 From: wangzhaohao Date: Fri, 30 May 2025 19:43:39 +0800 Subject: [PATCH] add AuthMessageProcessorFuzzTest Signed-off-by: wangzhaohao --- test/servicesfuzztest/BUILD.gn | 1 + .../authmessageprocessor_fuzzer/BUILD.gn | 77 ++++++++ .../auth_message_processor_fuzzer.cpp | 164 ++++++++++++++++++ .../auth_message_processor_fuzzer.h | 21 +++ .../authmessageprocessor_fuzzer/corpus/init | 13 ++ .../authmessageprocessor_fuzzer/project.xml | 25 +++ 6 files changed, 301 insertions(+) create mode 100644 test/servicesfuzztest/authmessageprocessor_fuzzer/BUILD.gn create mode 100644 test/servicesfuzztest/authmessageprocessor_fuzzer/auth_message_processor_fuzzer.cpp create mode 100644 test/servicesfuzztest/authmessageprocessor_fuzzer/auth_message_processor_fuzzer.h create mode 100644 test/servicesfuzztest/authmessageprocessor_fuzzer/corpus/init create mode 100644 test/servicesfuzztest/authmessageprocessor_fuzzer/project.xml diff --git a/test/servicesfuzztest/BUILD.gn b/test/servicesfuzztest/BUILD.gn index bfa3d6841..e9a8a64c8 100644 --- a/test/servicesfuzztest/BUILD.gn +++ b/test/servicesfuzztest/BUILD.gn @@ -15,6 +15,7 @@ group("fuzztest") { testonly = true deps = [ + "authmessageprocessor_fuzzer:fuzztest", "cryptomgr_fuzzer:fuzztest", "devicediscovery_fuzzer:fuzztest", "devicelist_fuzzer:fuzztest", diff --git a/test/servicesfuzztest/authmessageprocessor_fuzzer/BUILD.gn b/test/servicesfuzztest/authmessageprocessor_fuzzer/BUILD.gn new file mode 100644 index 000000000..03a5e37e8 --- /dev/null +++ b/test/servicesfuzztest/authmessageprocessor_fuzzer/BUILD.gn @@ -0,0 +1,77 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/test.gni") +import("//foundation/distributedhardware/device_manager/device_manager.gni") + +##############################fuzztest########################################## +ohos_fuzztest("AuthMessageProcessorFuzzTest") { + module_out_path = fuzz_test_output_path + fuzz_config_file = + "${devicemanager_path}/test/servicesfuzztest/authmessageprocessor_fuzzer" + + include_dirs = [ + "${innerkits_path}/native_cpp/include", + "${innerkits_path}/native_cpp/include/ipc", + "${innerkits_path}/native_cpp/include/ipc/standard", + ] + + cflags = [ + "-g", + "-O0", + "-Dprivate=public", + "-Dprotected=public", + "-Werror", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + + sources = [ "auth_message_processor_fuzzer.cpp" ] + + deps = [ + "${innerkits_path}/native_cpp:devicemanagersdk", + "${json_path}:devicemanagerjson", + "${services_path}:devicemanagerservicetest", + "${servicesimpl_path}:devicemanagerserviceimpl", + ] + + external_deps = [ + "bounds_checking_function:libsec_shared", + "device_auth:deviceauth_sdk", + "device_info_manager:distributed_device_profile_common", + "device_info_manager:distributed_device_profile_sdk", + "dsoftbus:softbus_client", + "ffrt:libffrt", + "hilog:libhilog", + "init:libbegetutil", + "ipc:ipc_single", + "kv_store:distributeddata_inner", + "samgr:samgr_proxy", + ] + + defines = [ + "HI_LOG_ENABLE", + "DH_LOG_TAG=\"AuthMessageProcessorFuzzTest\"", + "LOG_DOMAIN=0xD004110", + ] +} + +############################################################################### +group("fuzztest") { + testonly = true + + deps = [ ":AuthMessageProcessorFuzzTest" ] +} +############################################################################### diff --git a/test/servicesfuzztest/authmessageprocessor_fuzzer/auth_message_processor_fuzzer.cpp b/test/servicesfuzztest/authmessageprocessor_fuzzer/auth_message_processor_fuzzer.cpp new file mode 100644 index 000000000..73a030896 --- /dev/null +++ b/test/servicesfuzztest/authmessageprocessor_fuzzer/auth_message_processor_fuzzer.cpp @@ -0,0 +1,164 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#include +#include + +#include "auth_message_processor_fuzzer.h" + +#include "auth_manager.h" +#include "deviceprofile_connector.h" +#include "device_manager_service_listener.h" +#include "dm_anonymous.h" +#include "dm_auth_context.h" +#include "dm_auth_manager_base.h" +#include "dm_auth_message_processor.h" +#include "dm_auth_state_machine.h" +#include "dm_constants.h" +#include "dm_crypto.h" +#include "dm_log.h" + + +namespace OHOS { +namespace DistributedHardware { +namespace { +std::shared_ptr dmAuthMessageProcessor_ = std::make_shared(); +std::shared_ptr softbusConnector = std::make_shared(); +std::shared_ptr listener = std::make_shared(); +std::shared_ptr hiChainAuthConnector = std::make_shared(); +std::shared_ptr hiChainConnector = std::make_shared(); +std::shared_ptr authManager = std::make_shared(softbusConnector, + hiChainConnector, listener, hiChainAuthConnector); +std::shared_ptr context_ = authManager->GetAuthContext(); +} + +void GenerateJsonObject(JsonObject &jsonObject, FuzzedDataProvider &fdp) +{ + jsonObject[TAG_DATA] = fdp.ConsumeRandomLengthString(); + jsonObject[TAG_PEER_PKG_NAME] = fdp.ConsumeRandomLengthString(); + jsonObject[TAG_DM_VERSION_V2] = fdp.ConsumeRandomLengthString(); + jsonObject[TAG_USER_ID] = fdp.ConsumeRandomLengthString(); + jsonObject[TAG_DEVICE_ID_HASH] = fdp.ConsumeRandomLengthString(); + jsonObject[TAG_ACCOUNT_ID_HASH] = fdp.ConsumeRandomLengthString(); + jsonObject[TAG_TOKEN_ID_HASH] = fdp.ConsumeRandomLengthString(); + jsonObject[TAG_BUNDLE_NAME_V2] = fdp.ConsumeRandomLengthString(); + jsonObject[TAG_EXTRA_INFO] = fdp.ConsumeRandomLengthString(); + jsonObject[TAG_PEER_BUNDLE_NAME_V2] = fdp.ConsumeRandomLengthString(); + jsonObject[DM_TAG_LOGICAL_SESSION_ID] = fdp.ConsumeIntegral(); + jsonObject[TAG_PEER_DISPLAY_ID] = fdp.ConsumeIntegral(); +} + +void AuthMessageProcessorFuzzTestNext(JsonObject &jsonObject) +{ + dmAuthMessageProcessor_ -> ParseAuthStartMessage(jsonObject, context_); + dmAuthMessageProcessor_ -> ParseNegotiateMessage(jsonObject, context_); + dmAuthMessageProcessor_ -> ParseMessageRespAclNegotiate(jsonObject, context_); + dmAuthMessageProcessor_ -> ParseMessageReqUserConfirm(jsonObject, context_); + dmAuthMessageProcessor_ -> ParseMessageRespUserConfirm(jsonObject, context_); + dmAuthMessageProcessor_ -> ParseMessageReqPinAuthStart(jsonObject, context_); + dmAuthMessageProcessor_ -> ParseMessageRespPinAuthStart(jsonObject, context_); + dmAuthMessageProcessor_ -> ParseMessageReqPinAuthNegotiate(jsonObject, context_); + dmAuthMessageProcessor_ -> ParseMessageRespPinAuthNegotiate(jsonObject, context_); + dmAuthMessageProcessor_ -> ParseMessageReqCredExchange(jsonObject, context_); + dmAuthMessageProcessor_ -> ParseMessageRspCredExchange(jsonObject, context_); + dmAuthMessageProcessor_ -> ParseMessageNegotiateTransmit(jsonObject, context_); + dmAuthMessageProcessor_ -> ParseMessageSyncReq(jsonObject, context_); + dmAuthMessageProcessor_ -> ParseMessageSyncResp(jsonObject, context_); + dmAuthMessageProcessor_ -> ParseMessageSinkFinish(jsonObject, context_); + dmAuthMessageProcessor_ -> ParseMessageSrcFinish(jsonObject, context_); + dmAuthMessageProcessor_ -> ParseMessageReverseUltrasonicStart(jsonObject, context_); + dmAuthMessageProcessor_ -> ParseMessageReverseUltrasonicDone(jsonObject, context_); + dmAuthMessageProcessor_ -> ParseMessageForwardUltrasonicStart(jsonObject, context_); + dmAuthMessageProcessor_ -> ParseMessageForwardUltrasonicNegotiate(jsonObject, context_); + dmAuthMessageProcessor_ -> CreateNegotiateMessage(context_, jsonObject); + dmAuthMessageProcessor_ -> CreateRespNegotiateMessage(context_, jsonObject); + dmAuthMessageProcessor_ -> CreateMessageReqUserConfirm(context_, jsonObject); + dmAuthMessageProcessor_ -> CreateMessageRespUserConfirm(context_, jsonObject); + dmAuthMessageProcessor_ -> CreateMessageReqPinAuthStart(context_, jsonObject); + dmAuthMessageProcessor_ -> CreateMessageRespPinAuthStart(context_, jsonObject); + dmAuthMessageProcessor_ -> CreateMessageReqPinAuthNegotiate(context_, jsonObject); + dmAuthMessageProcessor_ -> CreateMessageRespPinAuthNegotiate(context_, jsonObject); + dmAuthMessageProcessor_ -> CreateMessageReqCredExchange(context_, jsonObject); + dmAuthMessageProcessor_ -> CreateMessageRspCredExchange(context_, jsonObject); + dmAuthMessageProcessor_ -> CreateMessageReqCredAuthStart(context_, jsonObject); + dmAuthMessageProcessor_ -> CreateCredentialNegotiateMessage(context_, jsonObject); + dmAuthMessageProcessor_ -> CreateNegotiateOldMessage(context_, jsonObject); + dmAuthMessageProcessor_ -> CreateSyncMessage(context_, jsonObject); + dmAuthMessageProcessor_ -> CreateMessageSyncResp(context_, jsonObject); + dmAuthMessageProcessor_ -> CreateMessageFinish(context_, jsonObject); + dmAuthMessageProcessor_ -> CreateMessageForwardUltrasonicStart(context_, jsonObject); + dmAuthMessageProcessor_ -> CreateMessageReverseUltrasonicStart(context_, jsonObject); + dmAuthMessageProcessor_ -> CreateMessageForwardUltrasonicNegotiate(context_, jsonObject); + dmAuthMessageProcessor_ -> CreateMessageReverseUltrasonicDone(context_, jsonObject); +} + +void AuthMessageProcessorFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size < sizeof(int32_t))) { + return; + } + FuzzedDataProvider fdp(data, size); + std::string message = fdp.ConsumeRandomLengthString(); + std::string inputStr = fdp.ConsumeRandomLengthString(); + std::string compressed = fdp.ConsumeRandomLengthString(); + std::string trustDeviceId = fdp.ConsumeRandomLengthString(); + std::string encSyncMsg = fdp.ConsumeRandomLengthString(); + std::string enSyncMsg = fdp.ConsumeRandomLengthString(); + std::string aclStr = fdp.ConsumeRandomLengthString(); + uint32_t keyLen = fdp.ConsumeIntegralInRange(0, 1024); + uint32_t oriLen = fdp.ConsumeIntegralInRange(0, 1024); + std::vector sessionKey = fdp.ConsumeBytes(keyLen); + int32_t userId = fdp.ConsumeIntegral(); + int32_t skId = fdp.ConsumeIntegral(); + DistributedDeviceProfile::AccessControlProfile acl; + DistributedDeviceProfile::Accesser accesser; + DistributedDeviceProfile::Accessee accessee; + acl.SetExtraData(fdp.ConsumeRandomLengthString()); + accesser.SetAccesserExtraData(fdp.ConsumeRandomLengthString()); + accessee.SetAccesseeExtraData(fdp.ConsumeRandomLengthString()); + DmAccess access; + JsonObject jsonObject; + GenerateJsonObject(jsonObject, fdp); + dmAuthMessageProcessor_ -> ParseMessage(context_, message); + dmAuthMessageProcessor_ -> CreateMessage(DmMessageType::MSG_TYPE_REQ_ACL_NEGOTIATE, context_); + dmAuthMessageProcessor_ -> CreateAndSendMsg(DmMessageType::MSG_TYPE_REQ_ACL_NEGOTIATE, context_); + dmAuthMessageProcessor_ -> SaveSessionKey(sessionKey.data(), keyLen); + dmAuthMessageProcessor_ -> SaveSessionKeyToDP(userId, skId); + dmAuthMessageProcessor_ -> DeleteSessionKeyToDP(userId, skId); + dmAuthMessageProcessor_ -> CompressSyncMsg(inputStr); + dmAuthMessageProcessor_ -> DecompressSyncMsg(compressed, oriLen); + dmAuthMessageProcessor_ -> Base64Encode(inputStr); + dmAuthMessageProcessor_ -> Base64Decode(inputStr); + dmAuthMessageProcessor_ -> PutAccessControlList(context_, access, trustDeviceId); + dmAuthMessageProcessor_ -> EncryptSyncMessage(context_, access, encSyncMsg); + dmAuthMessageProcessor_ -> DecryptSyncMessage(context_, access, enSyncMsg); + dmAuthMessageProcessor_ -> ParseSyncMessage(context_, access, jsonObject); + dmAuthMessageProcessor_ -> CheckAccessValidityAndAssign(context_, access, access); + dmAuthMessageProcessor_ -> ACLToStr(acl, aclStr); + dmAuthMessageProcessor_ -> SetAccessControlList(context_, acl); + dmAuthMessageProcessor_ -> SetTransmitAccessControlList(context_, accesser, accessee); + dmAuthMessageProcessor_ -> SetLnnAccessControlList(context_, accesser, accessee); + AuthMessageProcessorFuzzTestNext(jsonObject); +} +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + OHOS::DistributedHardware::AuthMessageProcessorFuzzTest(data, size); + + return 0; +} diff --git a/test/servicesfuzztest/authmessageprocessor_fuzzer/auth_message_processor_fuzzer.h b/test/servicesfuzztest/authmessageprocessor_fuzzer/auth_message_processor_fuzzer.h new file mode 100644 index 000000000..bf270770c --- /dev/null +++ b/test/servicesfuzztest/authmessageprocessor_fuzzer/auth_message_processor_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef AUTH_MESSAGE_PROCESSOR_FUZZER_H +#define AUTH_MESSAGE_PROCESSOR_FUZZER_H + +#define FUZZ_PROJECT_NAME "authmessageprocessor_fuzzer" + +#endif // AUTH_MESSAGE_PROCESSOR_FUZZER_H diff --git a/test/servicesfuzztest/authmessageprocessor_fuzzer/corpus/init b/test/servicesfuzztest/authmessageprocessor_fuzzer/corpus/init new file mode 100644 index 000000000..9c560fe89 --- /dev/null +++ b/test/servicesfuzztest/authmessageprocessor_fuzzer/corpus/init @@ -0,0 +1,13 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +FUZZ diff --git a/test/servicesfuzztest/authmessageprocessor_fuzzer/project.xml b/test/servicesfuzztest/authmessageprocessor_fuzzer/project.xml new file mode 100644 index 000000000..66e1dcac4 --- /dev/null +++ b/test/servicesfuzztest/authmessageprocessor_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + -- Gitee