1 /* 2 * Copyright 2020 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #pragma once 18 19 #include "hci/command_interface.h" 20 #include "hci/hci_layer.h" 21 #include "os/fuzz/dev_null_queue.h" 22 #include "os/fuzz/fuzz_inject_queue.h" 23 #include "os/log.h" 24 25 #include <fuzzer/FuzzedDataProvider.h> 26 #include "fuzz/helpers.h" 27 28 namespace bluetooth { 29 namespace hci { 30 namespace fuzz { 31 32 template <typename T> 33 class FuzzCommandInterface : public CommandInterface<T> { 34 public: EnqueueCommand(std::unique_ptr<T> command,common::ContextualOnceCallback<void (hci::CommandCompleteView)> on_complete)35 void EnqueueCommand(std::unique_ptr<T> command, 36 common::ContextualOnceCallback<void(hci::CommandCompleteView)> on_complete) override {} 37 EnqueueCommand(std::unique_ptr<T> command,common::ContextualOnceCallback<void (hci::CommandStatusView)> on_status)38 void EnqueueCommand(std::unique_ptr<T> command, 39 common::ContextualOnceCallback<void(hci::CommandStatusView)> on_status) override {} 40 }; 41 42 class FuzzHciLayer : public HciLayer { 43 public: TurnOnAutoReply(FuzzedDataProvider * fdp)44 void TurnOnAutoReply(FuzzedDataProvider* fdp) { 45 auto_reply_fdp = fdp; 46 } 47 TurnOffAutoReply()48 void TurnOffAutoReply() { 49 auto_reply_fdp = nullptr; 50 } 51 EnqueueCommand(std::unique_ptr<hci::CommandBuilder> command,common::ContextualOnceCallback<void (hci::CommandCompleteView)> on_complete)52 void EnqueueCommand( 53 std::unique_ptr<hci::CommandBuilder> command, 54 common::ContextualOnceCallback<void(hci::CommandCompleteView)> on_complete) override { 55 on_command_complete_ = std::move(on_complete); 56 if (auto_reply_fdp != nullptr) { 57 injectCommandComplete(bluetooth::fuzz::GetArbitraryBytes(auto_reply_fdp)); 58 } 59 } 60 EnqueueCommand(std::unique_ptr<CommandBuilder> command,common::ContextualOnceCallback<void (hci::CommandStatusView)> on_status)61 void EnqueueCommand( 62 std::unique_ptr<CommandBuilder> command, 63 common::ContextualOnceCallback<void(hci::CommandStatusView)> on_status) override { 64 on_command_status_ = std::move(on_status); 65 if (auto_reply_fdp != nullptr) { 66 injectCommandStatus(bluetooth::fuzz::GetArbitraryBytes(auto_reply_fdp)); 67 } 68 } 69 GetAclQueueEnd()70 common::BidiQueueEnd<hci::AclBuilder, hci::AclView>* GetAclQueueEnd() override { 71 return acl_queue_.GetUpEnd(); 72 } 73 GetIsoQueueEnd()74 common::BidiQueueEnd<hci::IsoBuilder, hci::IsoView>* GetIsoQueueEnd() override { 75 return iso_queue_.GetUpEnd(); 76 } 77 RegisterEventHandler(hci::EventCode event,common::ContextualCallback<void (hci::EventView)> handler)78 void RegisterEventHandler(hci::EventCode event, common::ContextualCallback<void(hci::EventView)> handler) override { 79 event_handlers_[event] = handler; 80 } 81 UnregisterEventHandler(hci::EventCode event)82 void UnregisterEventHandler(hci::EventCode event) override { 83 auto it = event_handlers_.find(event); 84 if (it != event_handlers_.end()) { 85 event_handlers_.erase(it); 86 } 87 } 88 RegisterLeEventHandler(hci::SubeventCode event,common::ContextualCallback<void (hci::LeMetaEventView)> handler)89 void RegisterLeEventHandler(hci::SubeventCode event, 90 common::ContextualCallback<void(hci::LeMetaEventView)> handler) override { 91 le_event_handlers_[event] = handler; 92 } 93 UnregisterLeEventHandler(hci::SubeventCode event)94 void UnregisterLeEventHandler(hci::SubeventCode event) override { 95 auto it = le_event_handlers_.find(event); 96 if (it != le_event_handlers_.end()) { 97 le_event_handlers_.erase(it); 98 } 99 } 100 101 hci::SecurityInterface* GetSecurityInterface(common::ContextualCallback<void(hci::EventView)> event_handler) override; 102 103 hci::LeSecurityInterface* GetLeSecurityInterface( 104 common::ContextualCallback<void(hci::LeMetaEventView)> event_handler) override; 105 106 hci::AclConnectionInterface* GetAclConnectionInterface( 107 common::ContextualCallback<void(hci::EventView)> event_handler, 108 common::ContextualCallback<void(uint16_t, hci::ErrorCode)> on_disconnect, 109 common::ContextualCallback<void(hci::ErrorCode hci_status, uint16_t, uint8_t, uint16_t, uint16_t)> 110 on_read_remote_version) override; 111 112 hci::LeAclConnectionInterface* GetLeAclConnectionInterface( 113 common::ContextualCallback<void(hci::LeMetaEventView)> event_handler, 114 common::ContextualCallback<void(uint16_t, hci::ErrorCode)> on_disconnect, 115 common::ContextualCallback<void(hci::ErrorCode hci_status, uint16_t, uint8_t, uint16_t, uint16_t)> 116 on_read_remote_version) override; 117 118 hci::LeAdvertisingInterface* GetLeAdvertisingInterface( 119 common::ContextualCallback<void(hci::LeMetaEventView)> event_handler) override; 120 121 hci::LeScanningInterface* GetLeScanningInterface( 122 common::ContextualCallback<void(hci::LeMetaEventView)> event_handler) override; 123 124 hci::LeIsoInterface* GetLeIsoInterface(common::ContextualCallback<void(LeMetaEventView)> event_handler) override; 125 126 void injectArbitrary(FuzzedDataProvider& fdp); 127 ToString()128 std::string ToString() const override { 129 return "FuzzHciLayer"; 130 } 131 132 static const ModuleFactory Factory; 133 134 protected: ListDependencies(ModuleList * list)135 void ListDependencies(ModuleList* list) override {} 136 void Start() override; 137 void Stop() override; 138 139 private: 140 void injectAclData(std::vector<uint8_t> data); 141 142 void injectCommandComplete(std::vector<uint8_t> data); 143 void injectCommandStatus(std::vector<uint8_t> data); 144 145 void injectEvent(FuzzedDataProvider& fdp); 146 void injectLeEvent(FuzzedDataProvider& fdp); 147 148 void injectSecurityEvent(std::vector<uint8_t> data); 149 void injectLeSecurityEvent(std::vector<uint8_t> data); 150 151 void injectAclEvent(std::vector<uint8_t> data); 152 void injectAclDisconnect(FuzzedDataProvider& fdp); 153 void injectLeAclEvent(std::vector<uint8_t> data); 154 void injectLeAclDisconnect(FuzzedDataProvider& fdp); 155 156 void injectLeAdvertisingEvent(std::vector<uint8_t> data); 157 158 void injectLeScanningEvent(std::vector<uint8_t> data); 159 void injectLeIsoEvent(std::vector<uint8_t> data); 160 161 FuzzedDataProvider* auto_reply_fdp; 162 163 common::BidiQueue<hci::AclView, hci::AclBuilder> acl_queue_{3}; 164 common::BidiQueue<hci::IsoView, hci::IsoBuilder> iso_queue_{3}; 165 os::fuzz::DevNullQueue<AclBuilder>* acl_dev_null_; 166 os::fuzz::FuzzInjectQueue<AclView>* acl_inject_; 167 168 FuzzCommandInterface<AclCommandBuilder> acl_connection_interface_{}; 169 FuzzCommandInterface<AclCommandBuilder> le_acl_connection_interface_{}; 170 FuzzCommandInterface<SecurityCommandBuilder> security_interface_{}; 171 FuzzCommandInterface<LeSecurityCommandBuilder> le_security_interface_{}; 172 FuzzCommandInterface<LeAdvertisingCommandBuilder> le_advertising_interface_{}; 173 FuzzCommandInterface<LeScanningCommandBuilder> le_scanning_interface_{}; 174 FuzzCommandInterface<LeIsoCommandBuilder> le_iso_interface_{}; 175 176 common::ContextualOnceCallback<void(hci::CommandCompleteView)> on_command_complete_; 177 common::ContextualOnceCallback<void(hci::CommandStatusView)> on_command_status_; 178 179 std::map<hci::EventCode, common::ContextualCallback<void(hci::EventView)>> event_handlers_; 180 std::map<hci::SubeventCode, common::ContextualCallback<void(hci::LeMetaEventView)>> le_event_handlers_; 181 182 common::ContextualCallback<void(hci::EventView)> security_event_handler_; 183 common::ContextualCallback<void(hci::LeMetaEventView)> le_security_event_handler_; 184 common::ContextualCallback<void(hci::EventView)> acl_event_handler_; 185 common::ContextualCallback<void(uint16_t, hci::ErrorCode)> acl_on_disconnect_; 186 common::ContextualCallback<void(hci::LeMetaEventView)> le_acl_event_handler_; 187 common::ContextualCallback<void(uint16_t, hci::ErrorCode)> le_acl_on_disconnect_; 188 common::ContextualCallback<void(hci::LeMetaEventView)> le_advertising_event_handler_; 189 common::ContextualCallback<void(hci::LeMetaEventView)> le_scanning_event_handler_; 190 common::ContextualCallback<void(hci::LeMetaEventView)> le_iso_event_handler_; 191 }; 192 193 } // namespace fuzz 194 } // namespace hci 195 } // namespace bluetooth 196