| #include "nfc_integration_fuzzer_impl.h" |
| |
| #include <android-base/logging.h> |
| #include <android-base/stringprintf.h> |
| #include <fuzzer/FuzzedDataProvider.h> |
| |
| #include "nfa_ce_api.h" |
| #include "nfa_ee_api.h" |
| #include "nfa_p2p_api.h" |
| #include "nfa_rw_api.h" |
| #include "nfa_sys.h" |
| #include "nfc_api.h" |
| #include "nfc_int.h" |
| #include "nfc_task_helpers.h" |
| #include "rw_int.h" |
| |
| extern uint32_t g_tick_count; |
| extern tRW_CB rw_cb; |
| |
| FuzzedDataProvider* g_fuzzed_data; |
| |
| static bool g_saw_event = false; |
| static tNFA_EE_DISCOVER_REQ g_ee_info; |
| |
| void fuzz_cback(tRW_EVENT event, tRW_DATA *p_rw_data) { |
| (void)event; |
| (void)p_rw_data; |
| } |
| constexpr int32_t kMaxFramesSize = |
| USHRT_MAX - NFC_HDR_SIZE - NCI_MSG_OFFSET_SIZE - NCI_DATA_HDR_SIZE - 3; |
| |
| static void nfa_dm_callback(uint8_t event, tNFA_DM_CBACK_DATA*) { |
| g_saw_event = true; |
| LOG(INFO) << android::base::StringPrintf("nfa_dm_callback got event %d", |
| event); |
| } |
| |
| static void nfa_conn_callback(uint8_t event, tNFA_CONN_EVT_DATA*) { |
| LOG(INFO) << android::base::StringPrintf("nfa_conn_callback got event %d", |
| event); |
| g_saw_event = true; |
| } |
| |
| static void nfa_ee_callback(tNFA_EE_EVT event, tNFA_EE_CBACK_DATA* p_data) { |
| switch (event) { |
| case NFA_EE_DISCOVER_REQ_EVT: { |
| memcpy(&g_ee_info, &p_data->discover_req, sizeof(g_ee_info)); |
| break; |
| } |
| } |
| } |
| |
| // From packages/apps/Nfc/nci/jni/PeerToPeer.cpp |
| #define LLCP_DATA_LINK_TIMEOUT 2000 |
| |
| void nfc_process_timer_evt(void); |
| void nfa_p2p_callback(tNFA_P2P_EVT, tNFA_P2P_EVT_DATA*) {} |
| |
| static tNFC_PROTOCOL GetProtocol(const Protocol& protocol) { |
| switch (protocol.value()) { |
| case Protocol::FUZZER_PROTOCOL_UNKNOWN: { |
| return NFC_PROTOCOL_UNKNOWN; |
| } |
| case Protocol::FUZZER_PROTOCOL_T1T: { |
| return NFC_PROTOCOL_T1T; |
| } |
| case Protocol::FUZZER_PROTOCOL_T2T: { |
| return NFC_PROTOCOL_T2T; |
| } |
| case Protocol::FUZZER_PROTOCOL_T3T: { |
| return NFC_PROTOCOL_T3T; |
| } |
| case Protocol::FUZZER_PROTOCOL_T5T: { |
| return NFC_PROTOCOL_T5T; |
| } |
| case Protocol::FUZZER_PROTOCOL_ISO_DEP: { |
| return NFC_PROTOCOL_ISO_DEP; |
| } |
| case Protocol::FUZZER_PROTOCOL_NFC_DEP: { |
| return NFC_PROTOCOL_NFC_DEP; |
| } |
| case Protocol::FUZZER_PROTOCOL_MIFARE: { |
| return NFC_PROTOCOL_MIFARE; |
| } |
| case Protocol::FUZZER_PROTOCOL_ISO15693: { |
| return NFC_PROTOCOL_ISO15693; |
| } |
| case Protocol::FUZZER_PROTOCOL_B_PRIME: { |
| return NFC_PROTOCOL_B_PRIME; |
| } |
| case Protocol::FUZZER_PROTOCOL_KOVIO: { |
| return NFC_PROTOCOL_KOVIO; |
| } |
| } |
| } |
| |
| static tNFC_DISCOVERY_TYPE GetDiscovery(const DiscoveryType& type) { |
| switch (type.value()) { |
| case DiscoveryType::FUZZER_DISCOVERY_TYPE_POLL_A: { |
| return NFC_DISCOVERY_TYPE_POLL_A; |
| } |
| case DiscoveryType::FUZZER_DISCOVERY_TYPE_POLL_B: { |
| return NFC_DISCOVERY_TYPE_POLL_B; |
| } |
| case DiscoveryType::FUZZER_DISCOVERY_TYPE_POLL_F: { |
| return NFC_DISCOVERY_TYPE_POLL_F; |
| } |
| case DiscoveryType::FUZZER_DISCOVERY_TYPE_POLL_V: { |
| return NFC_DISCOVERY_TYPE_POLL_V; |
| } |
| case DiscoveryType::FUZZER_DISCOVERY_TYPE_POLL_A_ACTIVE: { |
| return NFC_DISCOVERY_TYPE_POLL_A_ACTIVE; |
| } |
| case DiscoveryType::FUZZER_DISCOVERY_TYPE_POLL_F_ACTIVE: { |
| return NFC_DISCOVERY_TYPE_POLL_F_ACTIVE; |
| } |
| case DiscoveryType::FUZZER_DISCOVERY_TYPE_LISTEN_A: { |
| return NFC_DISCOVERY_TYPE_LISTEN_A; |
| } |
| case DiscoveryType::FUZZER_DISCOVERY_TYPE_LISTEN_B: { |
| return NFC_DISCOVERY_TYPE_LISTEN_B; |
| } |
| case DiscoveryType::FUZZER_DISCOVERY_TYPE_LISTEN_F: { |
| return NFC_DISCOVERY_TYPE_LISTEN_F; |
| } |
| case DiscoveryType::FUZZER_DISCOVERY_TYPE_LISTEN_A_ACTIVE: { |
| return NFC_DISCOVERY_TYPE_LISTEN_A_ACTIVE; |
| } |
| case DiscoveryType::FUZZER_DISCOVERY_TYPE_LISTEN_F_ACTIVE: { |
| return NFC_DISCOVERY_TYPE_LISTEN_F_ACTIVE; |
| } |
| case DiscoveryType::FUZZER_DISCOVERY_TYPE_LISTEN_ISO15693: { |
| return NFC_DISCOVERY_TYPE_LISTEN_ISO15693; |
| } |
| case DiscoveryType::FUZZER_DISCOVERY_TYPE_POLL_B_PRIME: { |
| return NFC_DISCOVERY_TYPE_POLL_B_PRIME; |
| } |
| case DiscoveryType::FUZZER_DISCOVERY_TYPE_POLL_KOVIO: { |
| return NFC_DISCOVERY_TYPE_POLL_KOVIO; |
| } |
| case DiscoveryType::FUZZER_DISCOVERY_TYPE_LISTEN_B_PRIME: { |
| return NFC_DISCOVERY_TYPE_LISTEN_B_PRIME; |
| } |
| } |
| } |
| |
| std::vector<uint8_t> SerializeTechParameters( |
| const tNFC_RF_TECH_PARAMS& params) { |
| std::vector<uint8_t> vec; |
| |
| switch (params.mode) { |
| case NCI_DISCOVERY_TYPE_POLL_A: { |
| const tNFC_RF_PA_PARAMS* pa = ¶ms.param.pa; |
| vec.push_back(pa->sens_res[0]); |
| vec.push_back(pa->sens_res[1]); |
| vec.push_back(pa->nfcid1_len); |
| vec.insert(vec.end(), pa->nfcid1, pa->nfcid1 + pa->nfcid1_len); |
| |
| // sel_rsp of 0 is the same as not having it, so we just always send it |
| vec.push_back(1); |
| vec.push_back(pa->sel_rsp); |
| |
| vec.push_back(pa->hr_len); |
| vec.insert(vec.end(), pa->hr, pa->hr + pa->hr_len); |
| break; |
| } |
| default: { |
| abort(); |
| } |
| } |
| |
| return vec; |
| } |
| |
| // Serialize an NFC Activation event back to the spec wire format |
| std::vector<uint8_t> SerializeNfcActivate( |
| const tNFC_ACTIVATE_DEVT& activate, uint8_t buff_size, uint8_t num_buff, |
| const std::string& rf_tech_param_buffer, |
| const std::string& intf_param_buffer) { |
| std::vector<uint8_t> packet; |
| packet.push_back(activate.rf_disc_id); |
| packet.push_back(activate.intf_param.type); |
| packet.push_back(activate.protocol); |
| packet.push_back(activate.rf_tech_param.mode); |
| packet.push_back(buff_size); |
| packet.push_back(num_buff); |
| |
| std::vector<uint8_t> tech_parameters( |
| rf_tech_param_buffer.begin(), |
| rf_tech_param_buffer |
| .end()); // = SerializeTechParameters(activate.rf_tech_param); |
| if (tech_parameters.size() > 256) { |
| tech_parameters.resize(256); |
| } |
| packet.push_back(tech_parameters.size()); |
| packet.insert(packet.end(), tech_parameters.begin(), tech_parameters.end()); |
| |
| packet.push_back(activate.data_mode); |
| packet.push_back(activate.tx_bitrate); |
| packet.push_back(activate.rx_bitrate); |
| |
| std::vector<uint8_t> activation_parameters(intf_param_buffer.begin(), |
| intf_param_buffer.end()); |
| if (activation_parameters.size() > 256) { |
| activation_parameters.resize(256); |
| } |
| |
| packet.push_back(activation_parameters.size()); |
| packet.insert(packet.end(), activation_parameters.begin(), |
| activation_parameters.end()); |
| return packet; |
| } |
| |
| void DoRfManageIntfActivated(const RfManageIntfActivated& activated) { |
| // The event we want to generate |
| tNFC_ACTIVATE_DEVT activate_event = {}; |
| activate_event.rf_disc_id = activated.rf_discovery_id(); |
| activate_event.protocol = GetProtocol(activated.rf_protocol()); |
| activate_event.data_mode = GetDiscovery(activated.data_mode()); |
| activate_event.tx_bitrate = activated.tx_bitrate(); |
| activate_event.rx_bitrate = activated.rx_bitrate(); |
| uint8_t buff_size = activated.buff_size(); |
| uint8_t num_buff = activated.num_buff(); |
| |
| std::vector<uint8_t> packet = SerializeNfcActivate( |
| activate_event, buff_size, num_buff, activated.rf_tech_param_buffer(), |
| activated.intf_param_buffer()); |
| |
| g_fake_hal->SimulatePacketArrival(NCI_MT_NTF, 0, NCI_GID_RF_MANAGE, |
| NCI_MSG_RF_INTF_ACTIVATED, packet.data(), |
| packet.size()); |
| } |
| |
| void DoRfManagementNtf(const RfManagementNtf& ntf) { |
| switch (ntf.opcode_case()) { |
| case RfManagementNtf::kIntfActivated: { |
| DoRfManageIntfActivated(ntf.intf_activated()); |
| break; |
| } |
| case RfManagementNtf::OPCODE_NOT_SET: { |
| break; |
| } |
| } |
| } |
| |
| void DoMtNtf(const MtNtf& ntf) { |
| switch (ntf.gid_case()) { |
| case MtNtf::kRfManage: { |
| DoRfManagementNtf(ntf.rf_manage()); |
| break; |
| } |
| case MtNtf::GID_NOT_SET: { |
| break; |
| } |
| } |
| } |
| |
| void DoStructuredPacket(const SimulateStructuredPacket& packet) { |
| switch (packet.packet_case()) { |
| case SimulateStructuredPacket::kNtf: { |
| DoMtNtf(packet.ntf()); |
| break; |
| } |
| case SimulateStructuredPacket::PACKET_NOT_SET: { |
| break; |
| } |
| } |
| } |
| |
| void DoPacket(const SimulatePacketArrival& packet) { |
| uint8_t mt = packet.mt(); |
| uint8_t pbf = packet.pbf(); |
| uint8_t gid = packet.gid(); |
| uint8_t opcode = static_cast<uint8_t>(packet.opcode()); |
| bool need_flush = false; |
| if (mt == NCI_MT_DATA) { |
| // The gid field will be used as the connection ID. We should handle this |
| // a lot better but for now we let the existing gid enum get interpreted |
| // as a connection ID. |
| // gid = 0; |
| opcode = 0; |
| } |
| |
| g_fake_hal->SimulatePacketArrival(mt, pbf, gid, opcode, |
| (unsigned char*)packet.packet().data(), |
| packet.packet().size()); |
| if (need_flush) { |
| DoAllTasks(false); |
| } |
| } |
| |
| void NfcIntegrationFuzzer::DoOneCommand( |
| std::vector<std::vector<uint8_t>>& bytes_container, |
| const Command& command) { |
| switch (command.command_case()) { |
| case Command::kSimulatePacketArrival: { |
| DoPacket(command.simulate_packet_arrival()); |
| break; |
| } |
| case Command::kSimulateHalEvent: { |
| g_fake_hal->SimulateHALEvent(command.simulate_hal_event().hal_event(), |
| command.simulate_hal_event().hal_status()); |
| break; |
| } |
| case Command::kSimulateStructuredPacket: { |
| DoStructuredPacket(command.simulate_structured_packet()); |
| break; |
| } |
| case Command::kSendRawFrame: { |
| std::vector<uint8_t> frame( |
| command.send_raw_frame().data(), |
| command.send_raw_frame().data() + command.send_raw_frame().size()); |
| uint16_t frameSize = |
| frame.size() <= kMaxFramesSize ? frame.size() : kMaxFramesSize; |
| NFA_SendRawFrame(frame.data(), frameSize, |
| /*presence check start delay*/ 0); |
| break; |
| } |
| case Command::kDoNciMessages: { |
| nfc_process_nci_messages(); |
| break; |
| } |
| case Command::kDoNfaTasks: { |
| nfc_process_nfa_messages(); |
| break; |
| } |
| case Command::kSimulateTimerEvent: { |
| nfc_process_timer_evt(); |
| break; |
| } |
| case Command::kSimulateQuickTimerEvent: { |
| nfc_process_quick_timer_evt(); |
| break; |
| } |
| case Command::kSelect: { |
| NFA_Select(command.select().rf_select_id(), |
| GetProtocol(command.select().protocol()), |
| command.select().rf_interface()); |
| break; |
| } |
| case Command::kConfigureUiccListenTech: { |
| if (g_ee_info.num_ee > 0) { |
| uint8_t handle = command.configure_uicc_listen_tech().ee_handle(); |
| handle = g_ee_info.ee_disc_info[handle % g_ee_info.num_ee].ee_handle; |
| NFA_CeConfigureUiccListenTech( |
| handle, command.configure_uicc_listen_tech().tech_mask()); |
| NFA_EeClearDefaultTechRouting(handle, 0xFF); |
| NFA_EeSetDefaultTechRouting(handle, 0xFF, 0, 0, 0, 0, 0); |
| } |
| break; |
| } |
| case Command::kRegisterT3T: { |
| uint8_t nfcid2[NCI_RF_F_UID_LEN] = {}; |
| uint8_t t3tPmm[NCI_T3T_PMM_LEN] = {}; |
| NFA_CeRegisterFelicaSystemCodeOnDH(0, nfcid2, t3tPmm, nfa_conn_callback); |
| const uint8_t SYS_CODE_PWR_STATE_HOST = 0x01; |
| NFA_EeAddSystemCodeRouting(0, NCI_DH_ID, SYS_CODE_PWR_STATE_HOST); |
| break; |
| } |
| case Command::kStartRfDiscovery: { |
| NFA_StartRfDiscovery(); |
| break; |
| } |
| case Command::kStopRfDiscovery: { |
| NFA_StopRfDiscovery(); |
| break; |
| } |
| case Command::kSetIsoListenTech: { |
| NFA_CeSetIsoDepListenTech( |
| fuzzed_data_.ConsumeIntegralInRange<uint8_t>(0, 0xFF)); |
| NFA_CeRegisterAidOnDH(nullptr, 0, nfa_conn_callback); |
| break; |
| } |
| case Command::kRwFormatTag: { |
| NFA_RwFormatTag(); |
| break; |
| } |
| case Command::kRwPresenceCheck: { |
| NFA_RwPresenceCheck(command.rw_presence_check().option()); |
| break; |
| } |
| case Command::kRwSetTagReadOnly: { |
| NFA_RwSetTagReadOnly(command.rw_set_tag_read_only()); |
| break; |
| } |
| case Command::kEeUpdateNow: { |
| NFA_EeUpdateNow(); |
| break; |
| } |
| case Command::kEeAddAidRouting: { |
| uint8_t handle = command.ee_add_aid_routing().ee_handle(); |
| if (g_ee_info.num_ee) { |
| handle = g_ee_info.ee_disc_info[handle % g_ee_info.num_ee].ee_handle; |
| } |
| std::vector<uint8_t> aid(command.ee_add_aid_routing().aid().data(), |
| command.ee_add_aid_routing().aid().data() + |
| command.ee_add_aid_routing().aid().size()); |
| tNFA_EE_PWR_STATE power_state = |
| command.ee_add_aid_routing().power_state(); |
| uint8_t aidInfo = command.ee_add_aid_routing().aid_info(); |
| NFA_EeAddAidRouting(handle, aid.size(), aid.data(), power_state, aidInfo); |
| break; |
| } |
| case Command::kReadNdef: { |
| NFA_RwReadNDef(); |
| break; |
| } |
| case Command::kDetectNdef: { |
| NFA_RwDetectNDef(); |
| break; |
| } |
| case Command::kWriteNdef: { |
| bytes_container.emplace_back(command.write_ndef().size() % 1024); |
| NFA_RwWriteNDef(bytes_container.back().data(), |
| bytes_container.back().size()); |
| break; |
| } |
| case Command::kP2PRegisterServer: { |
| NFA_P2pSetLLCPConfig(LLCP_MAX_MIU, LLCP_OPT_VALUE, LLCP_WAITING_TIME, |
| LLCP_LTO_VALUE, 0, 0, LLCP_DELAY_RESP_TIME, |
| LLCP_DATA_LINK_TIMEOUT, |
| LLCP_DELAY_TIME_TO_SEND_FIRST_PDU); |
| NFA_P2pRegisterServer( |
| command.p2p_register_server().server_sap() & 0xFF, NFA_P2P_DLINK_TYPE, |
| (char*)command.p2p_register_server().service_name().c_str(), |
| nfa_p2p_callback); |
| break; |
| } |
| case Command::kP2PAcceptConn: { |
| NFA_P2pAcceptConn(command.p2p_accept_conn().handle() & 0xFF, |
| command.p2p_accept_conn().miu() & 0xFFFF, |
| command.p2p_accept_conn().rw() & 0xFF); |
| break; |
| } |
| case Command::kP2PRegisterClient: { |
| NFA_P2pRegisterClient(NFA_P2P_DLINK_TYPE, nfa_p2p_callback); |
| break; |
| } |
| case Command::kP2PDeregister: { |
| NFA_P2pDeregister(command.p2p_deregister()); |
| break; |
| } |
| case Command::kP2PConnectBySap: { |
| NFA_P2pConnectBySap(command.p2p_connect_by_sap().handle(), |
| command.p2p_connect_by_sap().dsap(), |
| command.p2p_connect_by_sap().miu(), |
| command.p2p_connect_by_sap().rw()); |
| break; |
| } |
| case Command::kP2PConnectByName: { |
| NFA_P2pConnectByName( |
| command.p2p_connect_by_name().client_handle(), |
| (char*)command.p2p_connect_by_name().service_name().c_str(), |
| command.p2p_connect_by_name().miu(), |
| command.p2p_connect_by_name().rw()); |
| break; |
| } |
| case Command::kP2PSendUi: { |
| std::vector<uint8_t> buffer(command.p2p_send_ui().data().data(), |
| command.p2p_send_ui().data().data() + |
| command.p2p_send_ui().data().size()); |
| NFA_P2pSendUI(command.p2p_send_ui().handle(), |
| command.p2p_send_ui().dsap(), buffer.size(), buffer.data()); |
| break; |
| } |
| case Command::kP2PDisconnect: { |
| NFA_P2pDisconnect(command.p2p_disconnect().handle(), |
| command.p2p_disconnect().flush()); |
| break; |
| } |
| case Command::kPauseP2P: { |
| NFA_PauseP2p(); |
| break; |
| } |
| case Command::kResumeP2P: { |
| NFA_ResumeP2p(); |
| break; |
| } |
| case Command::kP2PReadData: { |
| std::vector<uint8_t> buffer((size_t)command.p2p_read_data().length() % |
| 1024); |
| bool is_more_data = false; |
| unsigned int actual_size = 0; |
| NFA_P2pReadData(command.p2p_read_data().handle(), buffer.size(), |
| &actual_size, buffer.data(), &is_more_data); |
| break; |
| } |
| case Command::kP2PSendData: { |
| std::vector<uint8_t> buffer(command.p2p_send_data().data().data(), |
| command.p2p_send_data().data().data() + |
| command.p2p_send_data().data().size()); |
| NFA_P2pSendData(command.p2p_send_data().handle(), buffer.size(), |
| buffer.data()); |
| break; |
| } |
| case Command::COMMAND_NOT_SET: { |
| break; |
| } |
| } |
| } |
| |
| NfcIntegrationFuzzer::NfcIntegrationFuzzer(const Session* session) |
| : session_(session), |
| fuzzed_data_( |
| reinterpret_cast<const uint8_t*>(session->data_provider().data()), |
| session->data_provider().size()) { |
| g_fuzzed_data = &fuzzed_data_; |
| } |
| |
| bool NfcIntegrationFuzzer::Setup() { |
| g_tick_count = 0; |
| memset(&g_ee_info, 0, sizeof(g_ee_info)); |
| NFA_Init(&fuzzed_hal_entry); |
| |
| rw_cb.p_cback = &fuzz_cback; |
| NFA_Enable(nfa_dm_callback, nfa_conn_callback); |
| DoAllTasks(false); |
| |
| NFA_EeRegister(nfa_ee_callback); |
| NFA_EeSetDefaultProtoRouting(NFC_DH_ID, NFA_PROTOCOL_MASK_ISO_DEP, 0, 0, 0, 0, |
| 0); |
| |
| DoPacket(session_->setup_packet()); |
| g_saw_event = false; |
| DoAllTasks(false); |
| if (!g_saw_event) { |
| return false; |
| } |
| |
| NFA_EnableListening(); |
| NFA_EnablePolling(NFA_TECHNOLOGY_MASK_A | NFA_TECHNOLOGY_MASK_B | |
| NFA_TECHNOLOGY_MASK_F | NFA_TECHNOLOGY_MASK_V | |
| NFA_TECHNOLOGY_MASK_B_PRIME | NFA_TECHNOLOGY_MASK_A_ACTIVE | |
| NFA_TECHNOLOGY_MASK_F_ACTIVE | NFA_TECHNOLOGY_MASK_KOVIO); |
| |
| NFA_EnableDtamode(static_cast<tNFA_eDtaModes>(session_->dta_mode())); |
| NFA_StartRfDiscovery(); |
| |
| DoAllTasks(false); |
| return true; |
| } |
| |
| void NfcIntegrationFuzzer::RunCommands() { |
| for (const Command& command : session_->commands()) { |
| DoOneCommand(bytes_container_, command); |
| } |
| } |
| |
| void NfcIntegrationFuzzer::TearDown() { |
| // Do any remaining tasks including pending timers |
| DoAllTasks(true); |
| |
| // Issue a disable command then clear pending tasks |
| // and timers again |
| NFA_Disable(false); |
| DoAllTasks(true); |
| } |
