1 /* 2 * Copyright 2020 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #pragma once 18 19 #include "hci/command_interface.h" 20 #include "hci/hci_layer.h" 21 #include "os/fuzz/dev_null_queue.h" 22 #include "os/fuzz/fuzz_inject_queue.h" 23 #include "os/log.h" 24 25 #include <fuzzer/FuzzedDataProvider.h> 26 #include "fuzz/helpers.h" 27 28 namespace bluetooth { 29 namespace hci { 30 namespace fuzz { 31 32 template <typename T> 33 class FuzzCommandInterface : public CommandInterface<T> { 34 public: EnqueueCommand(std::unique_ptr<T> command,common::ContextualOnceCallback<void (hci::CommandCompleteView)> on_complete)35 void EnqueueCommand(std::unique_ptr<T> command, 36 common::ContextualOnceCallback<void(hci::CommandCompleteView)> on_complete) override {} 37 EnqueueCommand(std::unique_ptr<T> command,common::ContextualOnceCallback<void (hci::CommandStatusView)> on_status)38 void EnqueueCommand(std::unique_ptr<T> command, 39 common::ContextualOnceCallback<void(hci::CommandStatusView)> on_status) override {} 40 }; 41 42 class FuzzHciLayer : public HciLayer { 43 public: TurnOnAutoReply(FuzzedDataProvider * fdp)44 void TurnOnAutoReply(FuzzedDataProvider* fdp) { 45 auto_reply_fdp = fdp; 46 } 47 TurnOffAutoReply()48 void TurnOffAutoReply() { 49 auto_reply_fdp = nullptr; 50 } 51 EnqueueCommand(std::unique_ptr<hci::CommandPacketBuilder> command,common::ContextualOnceCallback<void (hci::CommandCompleteView)> on_complete)52 void EnqueueCommand(std::unique_ptr<hci::CommandPacketBuilder> command, 53 common::ContextualOnceCallback<void(hci::CommandCompleteView)> on_complete) override { 54 on_command_complete_ = std::move(on_complete); 55 if (auto_reply_fdp != nullptr) { 56 injectCommandComplete(bluetooth::fuzz::GetArbitraryBytes(auto_reply_fdp)); 57 } 58 } 59 EnqueueCommand(std::unique_ptr<CommandPacketBuilder> command,common::ContextualOnceCallback<void (hci::CommandStatusView)> on_status)60 void EnqueueCommand(std::unique_ptr<CommandPacketBuilder> command, 61 common::ContextualOnceCallback<void(hci::CommandStatusView)> on_status) override { 62 on_command_status_ = std::move(on_status); 63 if (auto_reply_fdp != nullptr) { 64 injectCommandStatus(bluetooth::fuzz::GetArbitraryBytes(auto_reply_fdp)); 65 } 66 } 67 GetAclQueueEnd()68 common::BidiQueueEnd<hci::AclPacketBuilder, hci::AclPacketView>* GetAclQueueEnd() override { 69 return acl_queue_.GetUpEnd(); 70 } 71 RegisterEventHandler(hci::EventCode event,common::ContextualCallback<void (hci::EventPacketView)> handler)72 void RegisterEventHandler(hci::EventCode event, 73 common::ContextualCallback<void(hci::EventPacketView)> handler) override { 74 event_handlers_[event] = handler; 75 } 76 UnregisterEventHandler(hci::EventCode event)77 void UnregisterEventHandler(hci::EventCode event) override { 78 auto it = event_handlers_.find(event); 79 if (it != event_handlers_.end()) { 80 event_handlers_.erase(it); 81 } 82 } 83 RegisterLeEventHandler(hci::SubeventCode event,common::ContextualCallback<void (hci::LeMetaEventView)> handler)84 void RegisterLeEventHandler(hci::SubeventCode event, 85 common::ContextualCallback<void(hci::LeMetaEventView)> handler) override { 86 le_event_handlers_[event] = handler; 87 } 88 UnregisterLeEventHandler(hci::SubeventCode event)89 void UnregisterLeEventHandler(hci::SubeventCode event) override { 90 auto it = le_event_handlers_.find(event); 91 if (it != le_event_handlers_.end()) { 92 le_event_handlers_.erase(it); 93 } 94 } 95 96 hci::SecurityInterface* GetSecurityInterface( 97 common::ContextualCallback<void(hci::EventPacketView)> event_handler) override; 98 99 hci::LeSecurityInterface* GetLeSecurityInterface( 100 common::ContextualCallback<void(hci::LeMetaEventView)> event_handler) override; 101 102 hci::AclConnectionInterface* GetAclConnectionInterface( 103 common::ContextualCallback<void(hci::EventPacketView)> event_handler, 104 common::ContextualCallback<void(uint16_t, hci::ErrorCode)> on_disconnect) override; 105 106 hci::LeAclConnectionInterface* GetLeAclConnectionInterface( 107 common::ContextualCallback<void(hci::LeMetaEventView)> event_handler, 108 common::ContextualCallback<void(uint16_t, hci::ErrorCode)> on_disconnect) override; 109 110 hci::LeAdvertisingInterface* GetLeAdvertisingInterface( 111 common::ContextualCallback<void(hci::LeMetaEventView)> event_handler) override; 112 113 hci::LeScanningInterface* GetLeScanningInterface( 114 common::ContextualCallback<void(hci::LeMetaEventView)> event_handler) override; 115 116 void injectArbitrary(FuzzedDataProvider& fdp); 117 ToString()118 std::string ToString() const override { 119 return "FuzzHciLayer"; 120 } 121 122 static const ModuleFactory Factory; 123 124 protected: ListDependencies(ModuleList * list)125 void ListDependencies(ModuleList* list) override {} 126 void Start() override; 127 void Stop() override; 128 129 private: 130 void injectAclData(std::vector<uint8_t> data); 131 132 void injectCommandComplete(std::vector<uint8_t> data); 133 void injectCommandStatus(std::vector<uint8_t> data); 134 135 void injectEvent(FuzzedDataProvider& fdp); 136 void injectLeEvent(FuzzedDataProvider& fdp); 137 138 void injectSecurityEvent(std::vector<uint8_t> data); 139 void injectLeSecurityEvent(std::vector<uint8_t> data); 140 141 void injectAclEvent(std::vector<uint8_t> data); 142 void injectAclDisconnect(FuzzedDataProvider& fdp); 143 void injectLeAclEvent(std::vector<uint8_t> data); 144 void injectLeAclDisconnect(FuzzedDataProvider& fdp); 145 146 void injectLeAdvertisingEvent(std::vector<uint8_t> data); 147 148 void injectLeScanningEvent(std::vector<uint8_t> data); 149 150 FuzzedDataProvider* auto_reply_fdp; 151 152 common::BidiQueue<hci::AclPacketView, hci::AclPacketBuilder> acl_queue_{3}; 153 os::fuzz::DevNullQueue<AclPacketBuilder>* acl_dev_null_; 154 os::fuzz::FuzzInjectQueue<AclPacketView>* acl_inject_; 155 156 FuzzCommandInterface<ConnectionManagementCommandBuilder> acl_connection_interface_{}; 157 FuzzCommandInterface<LeConnectionManagementCommandBuilder> le_acl_connection_interface_{}; 158 FuzzCommandInterface<SecurityCommandBuilder> security_interface_{}; 159 FuzzCommandInterface<LeSecurityCommandBuilder> le_security_interface_{}; 160 FuzzCommandInterface<LeAdvertisingCommandBuilder> le_advertising_interface_{}; 161 FuzzCommandInterface<LeScanningCommandBuilder> le_scanning_interface_{}; 162 163 common::ContextualOnceCallback<void(hci::CommandCompleteView)> on_command_complete_; 164 common::ContextualOnceCallback<void(hci::CommandStatusView)> on_command_status_; 165 166 std::map<hci::EventCode, common::ContextualCallback<void(hci::EventPacketView)>> event_handlers_; 167 std::map<hci::SubeventCode, common::ContextualCallback<void(hci::LeMetaEventView)>> le_event_handlers_; 168 169 common::ContextualCallback<void(hci::EventPacketView)> security_event_handler_; 170 common::ContextualCallback<void(hci::LeMetaEventView)> le_security_event_handler_; 171 common::ContextualCallback<void(hci::EventPacketView)> acl_event_handler_; 172 common::ContextualCallback<void(uint16_t, hci::ErrorCode)> acl_on_disconnect_; 173 common::ContextualCallback<void(hci::LeMetaEventView)> le_acl_event_handler_; 174 common::ContextualCallback<void(uint16_t, hci::ErrorCode)> le_acl_on_disconnect_; 175 common::ContextualCallback<void(hci::LeMetaEventView)> le_advertising_event_handler_; 176 common::ContextualCallback<void(hci::LeMetaEventView)> le_scanning_event_handler_; 177 }; 178 179 } // namespace fuzz 180 } // namespace hci 181 } // namespace bluetooth 182